security-secrets

Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns

跳到安装

仓库: IgorWarzocha/Opencode-Workflows
最近来源活动: 2026年1月12日 18:16
检测到的 SKILL.md 语言: 英语
星标: 123
分支: 12

安装方式

默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。

用 Codex 或 Claude 帮你安装复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。

直接命令不会经过审查 Prompt；运行前请先检查来源。

npx skills add https://github.com/IgorWarzocha/Opencode-Workflows --skill security-secrets

命令会保持在同一行。复制前请横向滚动并检查完整内容。

想先保存到本地？可下载 SkillsMP 当前能够提供的文件。

检查来源文件

决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。

文件资源管理器

3 个文件

SKILL.md

来源说明 · 只读预览

返回搜索返回安装

command-creator

Create custom /slash commands for repetitive tasks. Use proactively for command creation, prompt automation, or workflow shortcuts. Examples: - user: "Make a /test command that runs pytest" → create command in opencode.json, set prompt to run tests with bash tool - user: "Add a /review command for PRs" → design prompt to fetch diff, analyze changes, generate review comments - user: "Automate this repetitive task" → identify pattern, create slash command with parameterized prompt - user: "Make a /deploy command" → design workflow (build, test, deploy), encode in command prompt

2026-01-27

agent-navigation-sop

Generate AGENTS.md for AI agent navigation. Covers build/test commands, coding conventions, task routing, and codebase structure. Use proactively during /init workflow or when creating agent-readable repository documentation. Examples: - user: "/init" → full AI navigation AGENTS.md + skill recommendations - user: "/init basic" → minimal AGENTS.md structure only - user: "Create AGENTS.md for this repo" → assess complexity, generate navigation doc - user: "Document codebase for AI agents" → structured AGENTS.md with task routing

2026-01-27

user-onboarding-sop

Generate AGENTS.md for end-user assistance. Covers setup, installation, running, and troubleshooting. Use proactively when user asks for "getting started" help or during /init user workflow. Examples: - user: "/init user" → user assistance AGENTS.md with official docs - user: "Create getting started guide" → installation + setup + troubleshooting - user: "Document how to use this repo" → user-focused AGENTS.md - user: "Help users run this software" → setup, prerequisites, usage patterns

2026-01-27

查看这个仓库的全部 Skills

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

# Quick grep scan (fast, high signal) rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" . rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" . rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" . # Dedicated scanners (thorough) gitleaks detect --source . --redact --no-git semgrep scan --config p/secrets --error trufflehog filesystem . --only-verified

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

Secret Type

Pattern

Notes

AWS Access Key

AKIA[0-9A-Z]{16}

Always 20 chars, starts AKIA

AWS Secret

(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]

40 chars base64-ish

Google API Key

AIza[0-9A-Za-z\-_]{35}

39 chars total

Google OAuth

[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com

Client ID

Google Service Account

"type":\s*"service_account"

In JSON files

GitHub Token

gh[pousr]_[A-Za-z0-9_]{36,}

ghp_/gho_/ghu_/ghs_/ghr_

GitHub PAT (fine-grained)

github_pat_[A-Za-z0-9_]{22,}

Newer format

GitLab Token

glpat-[A-Za-z0-9\-]{20,}

Personal access token

Stripe Secret

`sk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Restricted

`rk_(live

test)_[0-9a-zA-Z]{24,}`

Stripe Publishable

`pk_(live

test)_[0-9a-zA-Z]{24,}`

Slack Bot Token

xoxb-[A-Za-z0-9-]+

Bot token

Slack User Token

xoxp-[A-Za-z0-9-]+

User token

Slack Workflow Token

xwfp-[A-Za-z0-9-]+

Workflow token

Slack App Token

xapp-[A-Za-z0-9-]+

App-level token

Slack Webhook

https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+

Discord Token

[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}

Bot token

Discord Webhook

https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+

OpenAI Key

sk-[A-Za-z0-9]{48}

API key

Anthropic Key

sk-ant-[A-Za-z0-9\-]{32,}

API key

Twilio

SK[a-z0-9]{32}

API key SID

SendGrid

SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}

API key

Mailgun

key-[0-9a-zA-Z]{32}

API key

Mailchimp

[a-f0-9]{32}-us[0-9]{1,2}

API key

Firebase

(?i)firebase[a-z0-9\-]+\.firebaseio\.com

Database URL

Supabase

eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*

JWT (check context)

Heroku

[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}

API key

NPM Token

npm_[A-Za-z0-9]{36}

Publish token

PyPI Token

pypi-[A-Za-z0-9_-]{50,}

Upload token

Private Key

`-----BEGIN (RSA

Database URL

`(?i)(postgres

mysql

Password in URL

[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}

Basic auth

JWT Secret

`(?i)(jwt[_-]?secret

token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]`

Generic Secret

`(?i)(password

passwd

File Pattern

Risk Level

Why

.env*

CRITICAL

Often contains all secrets

*config*.js/ts/json

HIGH

App configuration

*secret*, *credential*

HIGH

Named suspiciously

docker-compose*.yml

HIGH

DB passwords, service creds

.github/workflows/*.yml

HIGH

CI/CD secrets

*test*, *spec*, *fixture*

MEDIUM

Test data with real creds

*.pem, *.key, *.p12

CRITICAL

Private keys

security-secrets

安装方式

检查来源文件

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

security-secrets

来源信息

安装方式

检查来源文件

同仓库更多 Skills

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format

同仓库更多 Skills

High-Signal Regex Patterns

CLI Scanning Commands

Files to Prioritize

Redaction Format