菜单
Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Follow-up review that never trusts a commit message — always re-reads the actual diff before resolving a thread. Cites a real source for new issues, matching review-advanced.
Rigorous sequential-audit code review with a dedicated security block and cited pedagogical lessons. Customize for your project.
Review de suivi qui ne fait jamais confiance à un message de commit — relit toujours le diff réel avant de résoudre un thread. Cite une source réelle pour les nouveaux problèmes, comme review-advanced.
Code review rigoureuse à audits séquentiels, avec bloc sécurité dédié et leçons pédagogiques sourcées. À personnaliser pour votre projet.
Complete review of a documentation-focused MR/PR with 5 sequential audits oriented for documentation projects (markdown-quality, link-validity, terminology, freshness, examples-validity). No code-architecture audits, no React patterns, no SOLID. An orchestrator runs each audit one by one. Generates an .md report and posts it directly on the MR/PR. Direct mode with sourced lessons.
Follow-up review to verify corrections on a MR. Sequential execution to avoid memory spikes. Checks blocking issues, detects new problems, and posts a concise report on GitLab.
| name | security |
| description | Code scan to detect secrets before commit. Use before git add/commit/push or on demand. Checks for tokens, API keys, credentials, and other sensitive data. |
Read .claude/roles/code-reviewer.md — adopt this profile and follow all its rules.
This skill activates:
git commit or git push/security)flux security-scan (full repo scan)| Pattern | Example | Regex |
|---|---|---|
| GitLab PAT | glpat-xxxx | glpat-[a-zA-Z0-9_-]{20,} |
| GitHub PAT | ghp_xxxx | gh[ps]_[a-zA-Z0-9]{36,} |
| GitHub OAuth | gho_xxxx | gho_[a-zA-Z0-9]{36,} |
| OpenAI | sk-xxxx | sk-[a-zA-Z0-9]{32,} |
| Anthropic | sk-ant-xxxx | sk-ant-[a-zA-Z0-9-]{32,} |
| AWS Access Key | AKIA... | AKIA[0-9A-Z]{16} |
| AWS Secret | - | [a-zA-Z0-9/+=]{40} (AWS context) |
| Slack Token | xox[baprs]- | xox[baprs]-[a-zA-Z0-9-]+ |
| Discord Token | - | [MN][a-zA-Z0-9]{23,}\.[a-zA-Z0-9-_]{6}\.[a-zA-Z0-9-_]{27} |
| Pattern | Context |
|---|---|
password\s*=\s*["'][^"']+["'] | Hardcoded passwords |
secret\s*=\s*["'][^"']+["'] | Hardcoded secrets |
token\s*=\s*["'][^"']+["'] | Hardcoded tokens |
api[_-]?key\s*=\s*["'][^"']+["'] | Hardcoded API keys |
Bearer [a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+ | JWT tokens |
| File | Risk |
|---|---|
.env | Environment variables (often secrets) |
*.pem, *.key | Private keys |
secrets.*, credentials.* | Secret files |
config.toml with [secrets] section | Config with embedded secrets |
id_rsa, id_ed25519 | Private SSH keys |
SECURITY - Pre-commit Scan
Analyzing staged diff...
Result:
- Files scanned: X
- Secrets detected: Y
[If secrets found]
WARNING: Secrets detected!
File: src/config.ts
Line 42: token = "glpat-..." (GitLab PAT)
Action: Fix before committing.
Suggestions:
- Use an environment variable
- Move to a secure configuration file
SECURITY - Full Scan
Scanning entire repository...
Result:
- Files scanned: X
- Files ignored (.gitignore): Y
- Secrets detected: Z
[List of files with secrets]
git diff --cached --name-only # List of staged files
git diff --cached # Diff content
# Example with grep (the skill uses more advanced tools)
git diff --cached | grep -E "(glpat-|ghp_|sk-|password\s*=)"
Ignore if:
test_token, fake_key)xxxx or your-token-here)This skill applies the security rule:
Absolute rule: Never store tokens, API keys, or secrets in plain text in code or versioned files.
The scan produces a report with: