Detect hardcoded secrets like API keys, tokens, and passwords in text or code using Expanso Edge pipelines.

This skill is a legitimate-looking secrets scanner but it will (by design) send the text you give it to OpenAI's API when an OPENAI_API_KEY is supplied. That means any secrets in the input may leave your machine and may appear in the tool's output (the pipeline asks for "full_match" values). Before using it: 1) Decide whether you are comfortable sending repository contents or other sensitive data to an external LLM. 2) If you need local-only scanning, verify or implement the regex/local backend and remove or disable the openai_chat_completion processor. 3) Confirm the OPENAI_API_KEY behavior — if you don't set a key, test how the pipeline behaves (it may error). 4) If you must use the LLM, consider changing the output schema to redact full secrets (return only partial redactions) and avoid logging or storing full matches. 5) If deploying MCP mode, restrict access to the /scan endpoint (authentication, network controls) to prevent remote abuse. If you want, I can produce a minimal, local-only variant of the pipeline that never sends data to remote services and returns only redacted matches.

Type: OpenClaw Skill Name: expanso-secrets-scan Version: 1.0.0 The skill is designed to detect hardcoded secrets using an OpenAI LLM, as described in `SKILL.md` and `README.md`. It utilizes environment variables for configuration (`OPENAI_API_KEY`, `SECRET_TYPES`) and processes input via CLI or an HTTP server, sending it to the OpenAI API for analysis. All code and documentation align with the stated purpose, and there is no evidence of intentional harmful behavior, data exfiltration beyond the OpenAI API call for its core function, malicious execution, persistence mechanisms, or prompt injection attempts against the OpenClaw agent itself.