Menu
Use when sweeping for hardcoded secrets, accidentally-committed credentials, or .env leaks across the working tree and git history.
Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.
Baseado na classificação ocupacional SOC
| name | secrets-leak-scan |
| description | Use when sweeping for hardcoded secrets, accidentally-committed credentials, or .env leaks across the working tree and git history. |
| version | 1.0.0 |
| author | kbot |
| license | MIT |
| metadata | {"kbot":{"tags":["security","secrets","credentials","git-history","audit"],"related_skills":["local-vulnerability-hunt","dependency-audit"]}} |
A leaked key in git history is a leaked key forever. This skill catches them before they ship and rotates them when they already did.
git rebase that touched config filesA SECRET IN HISTORY IS A SECRET LEAKED.
ROTATE FIRST, EXPLAIN SECOND.
NEVER REWRITE PUBLIC HISTORY WITHOUT TEAM CONSENT.
Sweep what is on disk right now. The cheapest catch.
Patterns to grep, ranked by signal:
AKIA[0-9A-Z]{16} — AWS access keysk-[A-Za-z0-9]{20,} — OpenAI / Anthropic / genericxox[baprs]-[A-Za-z0-9-]+ — Slack tokensghp_[A-Za-z0-9]{36} / github_pat_[A-Za-z0-9_]{82} — GitHub PAT-----BEGIN (RSA |OPENSSH |EC )?PRIVATE KEY----- — any private keyeyJ[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,}\.[A-Za-z0-9_-]{20,} — JWT[A-Za-z0-9+/]{40,}={0,2} — long base64 (high false-positive, last resort)Files that warrant a manual look regardless of grep hits: .env*, config/*.yml, *.pem, *.key, *credentials*, *secrets*.
git rev-list --all | xargs -I{} git grep -E '<pattern>' {} -- '*.json' '*.yml' '*.env*' 2>/dev/null
For each hit:
Order of operations matters. Rotate before rewriting history — the old secret is already out there.
If history was pushed only to a private remote you control, and the team consents:
git filter-repo --invert-paths --path <leaked-file>
git push --force-with-lease
Notify every collaborator to re-clone — their local history still has the secret.
If the history was ever public, do not rely on rewriting. Treat the secret as permanently compromised. Rotation is the only remediation.
# Secrets Scan — <date> — <repo>
- Working tree hits: N (file:line list)
- Git history hits: M (commit:file list)
- Rotated: [list of credentials]
- Scrubbed: [list of paths] | not attempted (history is public)
## Open items
- [ ] <credential> still appears in commit <sha> — rotation required
File under ~/.kbot/security-audits/<session-id>/secrets-scan.md.
.gitignore prevents leaks (it doesn't, retroactively)bash — drive git rev-list, git grep, git filter-repokbot_read — confirm the hit is a real secret and not a fixturekbot --no-network — when you must scan a sensitive repo without phoning homeCreates distinctive editorial art direction for kernel.chat issues before implementation. Use when choosing an issue's visual concept, typography, composition, cover system, media grammar, responsive transformation, or motion intent; when a page feels generic or lacks character; or when original image and video assets need one coherent visual language.
Audits kernel.chat pages for responsive visual craft, accessibility, motion safety, interaction truth, runtime health, and production rendering. Use when reviewing an issue or artifact, checking whether a design is finished, comparing desktop and mobile, validating reduced motion or print, finding overflow and broken media, or proving that a published route matches the build.
Guides the design, layout, styling, and interactivity of kernel.chat editorial spreads and standalone artifact editions. Use this skill when editing or creating pages, React components, CSS files, or single-file HTML artifacts in the kernel.chat project to enforce the POPEYE-inspired bilingual design grammar and the interaction-language/artifact-language laws.
Use this skill to generate well-branded editorial interfaces and assets for kernel.chat ("Magazine for City Coders" — an independent magazine that is an unnamed homage to POPEYE), either for production or throwaway prototypes/mocks/etc. Contains essential design guidelines, colors, type, fonts, assets, and editorial UI components for prototyping.
Hand off a model from Blender (via BlenderMCP) into Unity (via MCP for Unity) — export the current Blender model, import it through import_model_file, and place it in the open scene. Use when the user has BlenderMCP and MCP for Unity both connected and wants to bring a Blender model into Unity. Does NOT drive Blender's own generators; BlenderMCP owns how the model got into Blender.
Generate images/videos/3D assets/audio via Higgsfield AI. Defaults: GPT Image 2 for image/design/text, Seedance 2.0 for video, Nano Banana 2/Lite/Pro for character/reference images, Marketing Studio for ads, Seed Audio 1.0 for audio. Use when: "generate an image", "make a video", "animate this photo", "image-to-video", "edit/stylize/remix this image", "reframe this video", "edit this video from a sketch", "create a 3D model/GLB", "create a sound effect", "make music", "text-to-audio", "create an ad", "make a UGC video", "unboxing", "presenter video", "import product from URL", or "analyze video virality". Supports image-to-3D (`multi_image_to_3d`), text-to-audio/music (`seed_audio`), workflow generation (`draw_to_video`, `reframe`), Marketing Studio, and Virality Predictor (`brain_activity`). Chain with higgsfield-soul-id for face/identity consistency. NOT for: Soul Character training (use higgsfield-soul-id), product photoshoots, marketplace listing cards, text/chat/TTS tasks.