菜单
Use this when a user asks to scan a repository or directory for secret-like values before sharing, packing, or sending context to an agent, using moonrun and the bundled portable secretscan WASM artifact from this skill.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use this when a user asks to convert local Word DOCX files to HTML or Markdown, apply Mammoth-style style maps, extract DOCX images beside converted HTML, or run the native MoonBit bobzhang/docx2html converter.
Use this when a user asks to inspect TOML-style config, inventory tables and keys, find duplicate keys or tables, extract dotted values, normalize simple TOML, or produce JSON config summaries using moonrun and the bundled portable tomlskill WASM artifact.
Use this when a user asks to inspect SVG files, inventory SVG structure, detect risky SVG features, or produce JSON SVG triage using moonrun and the bundled portable svgcheck WASM artifact.
Use this when a user asks to inspect Markdown structure, extract outlines, inventory links/tasks/code fences/front matter, or produce JSON document summaries using moonrun and the bundled portable mdskill WASM artifact.
Use this when a user asks to format, sanitize, inspect, outline, audit links, extract clean text, select nodes with CSS selectors, or convert local HTML to Markdown using moonrun and the bundled portable htmlfmt WASM artifact from this skill.
Use this when a user asks for a small portable ASCII cow text bubble, a playful CLI smoke test, or a minimal moonrun demo using the bundled portable cow WASM artifact from this skill.
| name | portable-secretscan |
| description | Use this when a user asks to scan a repository or directory for secret-like values before sharing, packing, or sending context to an agent, using moonrun and the bundled portable secretscan WASM artifact from this skill. |
Use this skill to scan WASI-visible text files for secret-like values before packing or sharing repository context. It is best for agent handoffs where the first requirement is not to leak local credentials into a prompt, issue, or generated report.
Run the bundled WASM artifact with moonrun from the project directory:
cd /path/to/project
moonrun /path/to/portable-secretscan/assets/secretscan.wasm --fail-on high .
Write a redacted Markdown report:
moonrun /path/to/portable-secretscan/assets/secretscan.wasm \
--output secret-scan.md \
.
Produce compact JSON for automation:
moonrun /path/to/portable-secretscan/assets/secretscan.wasm --json .
secretscan before using repo-packing or context-sharing tools.--fail-on high when the result should block sharing.--ext env,json,md,mbt,ts for focused scans.--json: write compact JSON.--fail-on LEVEL: return exit status 1 for low, medium, high, or
critical findings.--max-files N: cap the number of scanned files.--max-bytes N: cap inspected bytes per file after reading text.--limit N: cap printed findings.--ext a,b,c: include only listed extensions.--hidden: include hidden entries.--no-default-ignore: disable built-in ignores.--all-files: try every readable text file.--output PATH: write the report to a guest-visible path.This skill intentionally uses minimal miniio WASIp1 APIs. It reads text files
and walks directories, but it does not parse .gitignore, stream large files,
or prove the absence of secrets. It uses conservative heuristics and redacts
matched evidence.