Secret Detection

Git hook to detect secrets before commit.

This skill appears to do what it says: a local git pre-commit scanner implemented in Python that requires git and python3. Before installing, review the script (scripts/main.py) yourself. Key points to consider: - The scanner prints matched secrets (it includes a 'secret' field in its JSON output and prints a substring to the console). That can expose sensitive values in terminal history or CI logs — if you use this in CI or shared terminals, prefer redaction or change the script to mask secrets (e.g., show only the match type and filename/line, not the secret substring). - Installation is repo-local (.git/hooks/pre-commit). It will only run in that repository; it does not request external network access or credentials. - The README/SKILL.md claim it prints the first 20 characters of secrets, but the hook output prints up to 60 characters of file content — a small inconsistency to be aware of and correct if you want stricter redaction. - If you need organization-wide enforcement, consider a vetted tool (e.g., git-secrets, pre-commit frameworks, or a centralized scanning solution) rather than per-repo hooks. If you decide to install: run the script in a test repository first, and consider editing the scanner to mask or not include the actual secret value in outputs and saved logs.

Type: OpenClaw Skill Name: secret-detection Version: 1.0.0 The OpenClaw AgentSkills bundle 'secret-detection' is benign. It functions as a local git pre-commit hook to scan staged files for common secret patterns. The `scripts/main.py` file uses standard Python libraries and `subprocess` to interact with git, read local files, and install the hook. There is no evidence of data exfiltration, malicious execution, unauthorized persistence, or prompt injection attempts against the OpenClaw agent. The printing of partial secret content to the console is an explicit, documented feature for user identification, not an attempt at malicious data exfiltration.