secrets-audit

Scan projects and codebases for exposed secrets, API keys, tokens, passwords, and sensitive credentials. Detects hardcoded secrets in source code, config fil...

This skill appears coherent and implements a local secrets scanner as advertised. Before running it: (1) review the script (especially the git-history code) to ensure it matches your policies; (2) run it against a copy of the repository or in an isolated environment (container/VM) if the project contains very sensitive data; (3) be aware the script invokes git via subprocess.run for history checks — that's expected but review/limit where you run it; (4) there is a minor code bug near the end of scan_git_history (an apparent undefined variable reference) — consider fixing or reviewing the full script before CI/automation use; (5) the scanner uses entropy heuristics and regex rules that can produce false positives/negatives—review findings manually and rotate any real/high-severity credentials immediately; (6) do not assume the tool uploads results anywhere (it doesn't in the provided files), but verify you trust any environment where you run it.

Type: OpenClaw Skill Name: secrets-audit Version: 1.0.0 The secrets-audit skill is a legitimate security tool designed to identify hardcoded credentials, API keys, and sensitive data within a codebase. The primary logic in scripts/scan_secrets.py uses standard regex patterns and Shannon entropy calculations to detect leaks, and it includes a feature to audit git history using subprocess calls to 'git log'. No evidence of data exfiltration, malicious intent, or prompt injection was found; the tool operates locally and provides actionable remediation advice in its documentation.