credential-audit

Name: credential-audit
Availability: InStock
Author: abzhaw

Identify exposed secrets in source files, git history, and runtime logs.

Updated Feb 21, 2026

Search Tags:#secrets #credentials #log-analysis #git-history #secret-scanning #code-security

Ready to run

npx skills add https://github.com/abzhaw/juliaz_agents --skill credential-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: credential-audit
Source: https://github.com/abzhaw/juliaz_agents/tree/main/meta/agents/security-agent/skills/03-credential-audit
Command: npx skills add https://github.com/abzhaw/juliaz_agents --skill credential-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identify and mitigate leaked secrets by scanning source code, git history, and runtime logs to prevent credential exposure.

Core Features & Use Cases

Source file scan for hard-coded API keys, tokens, and passwords across common file types.
Git history scan to detect secrets accidentally committed in past commits.
Log file scan to find secrets in startup or PM2 logs.
Permissions and remediation guidance for secret files like .env.secrets and startup scripts.

Quick Start

Run credential-audit against your codebase to detect and report exposed secrets and insecure configurations.

Frequently Asked Questions about credential-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan for exposed secrets and hard-coded credentials in my source files?▼

To scan for exposed secrets, apply a secret-scanning tool against your codebase to detect hard-coded API keys, tokens, and passwords across multiple common file types. This pattern detection reports insecure configurations to prevent credential exposure.

Can I find API keys accidentally committed in past git history?▼

Yes, you can find API keys accidentally committed in git history by running a historical audit. This scans past commits to detect and report previously committed secrets, enabling targeted remediation to mitigate leaked credentials.

What is the best way to detect credentials printed in runtime logs?▼

The best way to detect credentials in runtime logs is through log analysis. Scanning startup or PM2 log files identifies printed secrets, allowing you to remediate the exposed credentials and adjust logging configurations to prevent leakage.

Does secret scanning work for deployment environments and permission files like .env.secrets?▼

Yes, secret scanning works for deployment environments by checking permission configurations. It provides remediation guidance for secret files like .env.secrets and startup scripts, ensuring insecure configurations are identified across your deployment setup.

What are the limitations of code security scanning for leaked secrets?▼

Limitations of code security scanning include relying on pattern detection, which may miss obfuscated credentials or unlisted file types. It focuses on source files, git history, and runtime logs, requiring manual remediation to secure identified leaks.