security-secrets

Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns

Aller à l'installation

Dépôt: jal-co/jalco-pi-mono
Dernière activité de la source: 6 mars 2026 à 20:21
Langue détectée de SKILL.md: anglais
Étoiles: 35
Forks: 1

Options d'installation

Le prompt qui vérifie d'abord la source est sélectionné par défaut. Vous pouvez passer à une commande directe ou télécharger une copie locale.

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Une commande directe contourne le prompt de vérification. Examinez la source avant de l'exécuter.

npx skills add https://github.com/jal-co/jalco-pi-mono --skill security-secrets

La commande reste sur une seule ligne. Faites défiler horizontalement pour la vérifier avant de la copier.

Vous préférez une copie locale ? Téléchargez les fichiers actuellement disponibles dans SkillsMP.

Vérifiez les fichiers source

Lisez SKILL.md et les fichiers associés affichés par SkillsMP avant de décider de l'installer.

Explorateur de fichiers

3 fichiers

SKILL.md

Instructions source · Aperçu en lecture seule

Retour à la recherche Retour à l’installation

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

# Quick grep scan (fast, high signal) rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" . rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" . rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" . # Dedicated scanners (thorough) gitleaks detect --source . --redact --no-git semgrep scan --config p/secrets --error trufflehog filesystem . --only-verified

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

security-secrets

Options d'installation

Vérifiez les fichiers source

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

security-secrets

Informations de source

Options d'installation

Vérifiez les fichiers source

Plus depuis ce dépôt

Plus depuis ce dépôt

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format