/secret-scan

> Detect exposed credentials, API keys, and sensitive data in the codebase.

170 stars

byMiosa-osa

View on GitHub Installation ↓

Best use case

/secret-scan is best used when you need a repeatable AI agent workflow instead of a one-off prompt.

> Detect exposed credentials, API keys, and sensitive data in the codebase.

Teams using /secret-scan should expect a more consistent output, faster repeated execution, less prompt rewriting.

When to use this skill

You want a reusable workflow that can be run more than once with consistent structure.

When not to use this skill

You only need a quick one-off answer and do not need a reusable workflow.
You cannot install or maintain the underlying files, dependencies, or repository context.

Installation

Claude Code / Cursor / Codex

$curl -o ~/.claude/skills/secret-scan/SKILL.md --create-dirs "https://raw.githubusercontent.com/Miosa-osa/canopy/main/library/skills/security/secret-scan/SKILL.md"

Manual Installation

Download SKILL.md from GitHub
Place it in .claude/skills/secret-scan/SKILL.md inside your project
Restart your AI agent — it will auto-discover the skill

How /secret-scan Compares

Feature / Agent	/secret-scan	Standard Approach
Platform Support	Not specified	Limited / Varies
Context Awareness	High	Baseline
Installation Complexity	Unknown	N/A

Frequently Asked Questions

What does this skill do?

> Detect exposed credentials, API keys, and sensitive data in the codebase.

Where can I find the source code?

You can find the source code on GitHub using the link provided at the top of the page.

SKILL.md Source

# /secret-scan

> Detect exposed credentials, API keys, and sensitive data in the codebase.

## Usage
```
/secret-scan [path] [--git-history] [--fix]
```

## What It Does
Scans the codebase (and optionally git history) for exposed secrets: AWS credentials, API keys, private keys, database connection strings, JWT tokens, and other sensitive data. Reports findings with exact file locations and remediation steps.

## Implementation
1. **Scan current files** -- regex patterns for common secret formats:
   - AWS: `AKIA[0-9A-Z]{16}`
   - Generic API key: `[a-zA-Z0-9]{32,}` in assignment context
   - Private keys: `-----BEGIN (RSA|EC|DSA) PRIVATE KEY-----`
   - Connection strings: `postgres://`, `mongodb://`, `redis://` with credentials
   - JWT: `eyJ[A-Za-z0-9-_]+\.eyJ[A-Za-z0-9-_]+\.[A-Za-z0-9-_]+`
2. **Scan git history** (if `--git-history`) -- check previous commits for secrets that were later removed.
3. **Check .gitignore** -- verify .env, credential files, and key files are ignored.
4. **Report** -- location, secret type, severity, and remediation.
5. **Fix** (if `--fix`) -- add entries to .gitignore, suggest secret rotation.

## Examples
```bash
# Scan current codebase
/secret-scan

# Include git history
/secret-scan --git-history

# Scan and auto-fix .gitignore
/secret-scan --fix

# Scan specific directory
/secret-scan config/
```

## Command