\r \r

Secret Scanner\r

\r Security skill that scans code, config files, and repos for accidentally leaked secrets and credentials.\r \r

When to Use This Skill\r

\r Use this skill when the user:\r \r

• Asks to "check for leaked secrets" or "scan for API keys"\r
• Wants to audit a repo or folder before committing or publishing\r
• Says "are there any hardcoded passwords in this code?"\r
• Asks to "find credentials" or "check for exposed tokens"\r
• Wants pre-commit or pre-publish security checks\r
• Mentions concern about accidentally checking in secrets\r \r

Capabilities\r

\r

• Detect 40+ secret patterns including:\r
  • AWS Access Keys, Secret Keys, Session Tokens\r
  • Azure Storage Keys, Connection Strings, SAS Tokens\r
  • GCP Service Account Keys, API Keys\r
  • GitHub / GitLab / Bitbucket Personal Access Tokens\r
  • OpenAI, Anthropic, Hugging Face API Keys\r
  • Slack Bot Tokens, Webhooks\r
  • Stripe, Twilio, SendGrid Keys\r
  • Database connection strings (MongoDB, PostgreSQL, MySQL, Redis)\r
  • SSH Private Keys, PEM/PFX Certificates\r
  • JWT Tokens, Bearer Tokens\r
  • Generic passwords in config files (password=, secret=, token=)\r
• Scan individual files, directories, or entire repos recursively\r
• Ignore binary files, node_modules, .git, and other non-relevant paths\r
• Output results as Markdown report or JSON\r
• Provide severity ratings (Critical, High, Medium, Low)\r
• Suggest remediation for each finding\r \r

How to Scan\r

\r

Scan a directory\r

python secret_scanner.py /path/to/project\r
```\r
\r
### Scan with JSON output\r
```bash\r
python secret_scanner.py /path/to/project --json\r
```\r
\r
### Scan and save report\r
```bash\r
python secret_scanner.py /path/to/project --output report.md\r
```\r
\r
### Within an Agent\r
```\r
"Scan this project for leaked secrets"\r
"Check if there are any API keys in the codebase"\r
"Run secret-scanner on the current directory"\r
"Find hardcoded passwords in my config files"\r
"Audit this repo before I push to GitHub"\r
```\r
\r
## Secret Patterns Detected\r
\r
### Cloud Provider Keys\r
| Provider | Secrets Detected |\r
|----------|-----------------|\r
| **AWS** | Access Key ID (`AKIA...`), Secret Access Key, Session Token |\r
| **Azure** | Storage Account Key, Connection String, SAS Token, Client Secret |\r
| **GCP** | API Key (`AIza...`), Service Account JSON, OAuth Client Secret |\r
\r
### AI / LLM Keys\r
| Service | Pattern |\r
|---------|---------|\r
| **OpenAI** | `sk-` prefixed API keys |\r
| **Anthropic** | `sk-ant-` prefixed keys |\r
| **Hugging Face** | `hf_` prefixed tokens |\r
| **Cohere** | API keys in config |\r
\r
### Developer Platforms\r
| Platform | Secrets Detected |\r
|----------|-----------------|\r
| **GitHub** | `ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_` tokens |\r
| **GitLab** | `glpat-` tokens |\r
| **Slack** | `xoxb-`, `xoxp-`, `xoxs-` tokens, webhook URLs |\r
| **Stripe** | `sk_live_`, `sk_test_`, `rk_live_` keys |\r
| **Twilio** | Account SID, Auth Token |\r
| **SendGrid** | `SG.` prefixed API keys |\r
\r
### Databases & Infrastructure\r
| Type | Pattern |\r
|------|---------|\r
| **MongoDB** | `mongodb://` or `mongodb+srv://` with credentials |\r
| **PostgreSQL** | `postgresql://` with embedded password |\r
| **MySQL** | `mysql://` with embedded password |\r
| **Redis** | `redis://` with password |\r
| **SSH** | `-----BEGIN (RSA\|EC\|OPENSSH) PRIVATE KEY-----` |\r
| **Certificates** | PEM, PFX, P12 with embedded keys |\r
\r
### Generic Patterns\r
| Pattern | Description |\r
|---------|-------------|\r
| **password=** | Hardcoded passwords in config/env files |\r
| **secret=** | Hardcoded secrets |\r
| **token=** | Hardcoded tokens |\r
| **Bearer** | Bearer tokens in code |\r
| **Basic Auth** | Base64-encoded basic auth headers |\r
| **JWT** | `eyJ` prefixed JWT tokens |\r
| **High Entropy** | Long random strings that look like secrets |\r
\r
## Severity Levels\r
\r
| Severity | Description | Examples |\r
|----------|-------------|----------|\r
| 🔴 **Critical** | Active production credentials | AWS Secret Key, Private Keys, DB passwords |\r
| 🟠 **High** | Service tokens with broad access | GitHub PAT, Slack Bot Token, Stripe Live Key |\r
| 🟡 **Medium** | Keys that may be test/dev | Test API keys, example tokens |\r
| 🟢 **Low** | Potential false positives | Generic password= in comments, placeholder values |\r
\r
## Files Scanned\r
\r
Scans these file types by default:\r
- Source code: `.py`, `.js`, `.ts`, `.java`, `.go`, `.rb`, `.php`, `.cs`, `.rs`\r
- Config: `.json`, `.yaml`, `.yml`, `.toml`, `.ini`, `.cfg`, `.conf`\r
- Environment: `.env`, `.env.local`, `.env.production`\r
- Shell: `.sh`, `.bash`, `.zsh`, `.ps1`\r
- Docs: `.md`, `.txt`\r
- Other: `Dockerfile`, `docker-compose.yml`, `Makefile`\r
\r
## Ignored Paths\r
\r
Automatically skips:\r
- `node_modules/`, `vendor/`, `venv/`, `.venv/`\r
- `.git/`, `.svn/`\r
- `__pycache__/`, `.pytest_cache/`\r
- Binary files, images, compiled outputs\r
- `package-lock.json`, `yarn.lock`\r
\r
## Remediation Guidance\r
\r
When secrets are found, the skill recommends:\r
1. **Rotate the secret immediately** — assume it's compromised\r
2. **Remove from code** — use environment variables or a secrets manager instead\r
3. **Add to .gitignore** — prevent `.env` and credential files from being committed\r
4. **Use git-filter-repo** — to remove secrets from git history\r
5. **Enable pre-commit hooks** — to catch secrets before they're committed\r
\r
## Requirements\r
- Python 3.7+\r
- No additional dependencies (uses Python standard library)\r
\r
## Entry Point\r
- **CLI:** `secret_scanner.py`\r
\r
## Tags\r
#security #secrets #credentials #api-keys #tokens #passwords #scanner #audit #pre-commit #leak-detection #cloud #aws #azure #gcp #devops\r