skills.rest
JKHeadley
JKHeadleyCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

credential-leak-detector

Detect leaked credentials in Bash command output before conversation exposure.

75|18|Updated Feb 19, 2026
Search Tags:#security#api keys#secret detection#redaction#credential scanning#bash output#post-tool hook
One-click install
npx skills add https://github.com/JKHeadley/instar --skill credential-leak-detector
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: credential-leak-detector
Source: https://github.com/JKHeadley/instar/tree/main/skills/credential-leak-detector
Command: npx skills add https://github.com/JKHeadley/instar --skill credential-leak-detector

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Bash output can expose API keys, private keys, tokens, and passwords to the conversation, logs, and context windows before anyone notices. This Skill catches those leaks immediately so sensitive values do not spread further.

Core Features & Use Cases

  • Critical blocking: Stops outputs containing live credentials like OpenAI keys, AWS keys, GitHub tokens, Stripe secrets, and PEM private keys.
  • Redaction and warnings: Masks high-severity matches and flags suspicious patterns such as bearer tokens, auth strings, and high-entropy secrets.
  • Post-tool-use protection: Works after a Bash command runs, which makes it ideal for diagnostics, container inspection, Kubernetes output, and any command that may print hidden secrets.

Quick Start

Ask the assistant to install this hook so every Bash command output is scanned for secrets, critical leaks are blocked, and suspicious values are redacted or flagged before they appear in chat.

Frequently Asked Questions about credential-leak-detector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent API keys and secrets from leaking in Bash command output?▼

Secret leak detection scans Bash command output during post-tool-use checks to block critical credentials like API keys and tokens before they reach the conversation.

Can I redact sensitive credentials like PEM private keys from terminal output automatically?▼

Yes, credential redaction masks high-severity matches such as PEM private keys and bearer tokens, replacing sensitive values with warnings before chat exposure.

What types of credentials does secret detection block in command line diagnostics?▼

Secret detection blocks live credentials including OpenAI keys, AWS keys, GitHub tokens, Stripe secrets, and PEM private keys found in command line output.

How does post-tool-use credential scanning work for Kubernetes and container inspection?▼

Post-tool-use credential scanning runs immediately after a Bash command executes, capturing Kubernetes or container output to flag hidden secrets before display.

Does this credential scanner require any external dependencies or security tools installed?▼

No external dependencies are required. The credential scanner operates as a standalone post-tool hook using regex pattern matching and severity-based blocking to redact secrets.

Why are bearer tokens and high-entropy strings flagged as suspicious during secret scanning?▼

Bearer tokens and high-entropy strings are flagged as suspicious because they frequently represent hidden authentication credentials or auth strings that pose security risks if exposed.

Related Skills

Explore More Software Engineering Skills→
xlelibertyxleliberty

writing-hookify-rules

Enforce custom safety guardrails on Claude tool interactions via regex rules.

Community
Intermediate
garethdainegarethdaine

pii-detector-redactor

Detect and redact PII from documents with configurable styles and audit logs.

Community
Advanced
Fandry96Fandry96
27

secrets-management

Manage secrets across CI/CD pipelines with Vault and cloud secret managers.

Community
Advanced
kinnerkarmanishkinnerkarmanish

security-auditor

Detect vulnerabilities and misconfigurations across codebases using static analysis, dependency checks, and secret detection.

Community
Advanced