This skill should be used when the user asks to "scan for secrets", "find API keys", "detect credentials", "check for hardcoded passwords", "find leaked tokens", "scan for sensitive keys", "check git history for secrets", "audit repository for credentials", or mentions secret detection, credential scanning, API key exposure, token leakage, password detection, or security key auditing.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.
This skill should be used when the user asks to "scan for secrets", "find API keys", "detect credentials", "check for hardcoded passwords", "find leaked tokens", "scan for sensitive keys", "check git history for secrets", "audit repository for credentials", or mentions secret detection, credential scanning, API key exposure, token leakage, password detection, or security key auditing.
A comprehensive secret detection skill for AI agents. Detects API keys, tokens, passwords, private keys, and credentials across 50+ services. Features entropy-based detection, git history scanning, and CI/CD integration.
Capabilities
Secret Detection - Find hardcoded secrets using 200+ regex patterns
Entropy Analysis - Detect high-entropy strings that may be secrets
Provider Coverage - AWS, GCP, Azure, GitHub, Stripe, and 50+ more
Git History Scan - Scan entire commit history for leaked secrets
File Type Support - Code, configs, env files, JSON, YAML, and more
Risk Scoring - Score findings by severity and exposure context
False Positive Filtering - Smart exclusions for test data and examples
# Scan entire history
/secret-scanner scan-git ./repo
# Scan last 100 commits
/secret-scanner scan-git ./repo --git-depth 100
# Scan specific branch
/secret-scanner scan-git ./repo --branch feature/auth
Git-Specific Findings
{"commit":"abc123","author":"developer@example.com","date":"2026-01-15T10:30:00Z","message":"Add API configuration","file":"config.py","secret_type":"stripe_secret_key","still_present":false,"removed_in":"def456"}
Test Files - *_test.*, *_spec.*, test_*.*, __tests__/*
Example Files - example.*, sample.*, demo.*
Documentation - *.md, *.rst, docs/*
Mock Data - Files containing "mock", "fake", "dummy"
Known Safe Patterns:
AKIAIOSFODNN7EXAMPLE (AWS example key)
sk_test_* (Stripe test keys)
pk_test_* (Stripe test publishable keys)
xoxb-PLACEHOLDER-EXAMPLE-TOKEN (Slack example)
Allowlist Configuration
Create .secret-scanner-allowlist.yaml:
# Allowlist configurationpatterns:# Regex patterns to ignore-"EXAMPLE_[A-Z_]+"-"test_api_key_\\d+"paths:# Files/directories to skip-"test/"-"fixtures/"-"*.example"hashes:# SHA256 hashes of known false positives-"abc123..."comments:# Inline comments that suppress warnings-"# secret-scanner:ignore"-"// nosecret"
Risk Scoring
Severity Levels
Score
Severity
Response
Examples
90-100
Critical
Immediate
AWS keys, private keys, prod DB passwords
70-89
High
Within 4 hours
API keys, OAuth tokens, service accounts
50-69
Medium
Within 24 hours
Test API keys, internal tokens
25-49
Low
Within 1 week
Entropy matches, partial credentials
0-24
Info
Review
Possible false positives
Factor Weights
Sensitivity (40%): Type of secret and potential damage
Exposure (30%): Where the secret was found
Verifiability (15%): Can the secret be validated as real
Scope (15%): Blast radius if exploited
Full methodology: references/risk-scoring.md
Remediation Workflow
Step 1: Immediate Actions
Revoke the secret - Invalidate immediately in provider console
Rotate credentials - Generate new secret
Update applications - Deploy new credentials
Audit access logs - Check for unauthorized usage
Step 2: Clean Up
Remove from code - Delete the hardcoded secret
Clean git history - Use BFG or git filter-branch
Force push - Update all branches
Invalidate caches - Clear CI/CD caches
Step 3: Prevention
Add to .gitignore - Prevent future commits
Install pre-commit hook - Block commits with secrets
Use secrets manager - AWS Secrets Manager, HashiCorp Vault
Environment variables - Store secrets in environment
