credential-leak-detector

Detect leaked credentials in Bash command output before conversation exposure.

75|18|Updated Feb 19, 2026

Search Tags:#security #api keys #secret detection #redaction #credential scanning #bash output #post-tool hook

Ready to run

npx skills add https://github.com/JKHeadley/instar --skill credential-leak-detector

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: credential-leak-detector
Source: https://github.com/JKHeadley/instar/tree/main/skills/credential-leak-detector
Command: npx skills add https://github.com/JKHeadley/instar --skill credential-leak-detector

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Bash output can expose API keys, private keys, tokens, and passwords to the conversation, logs, and context windows before anyone notices. This Skill catches those leaks immediately so sensitive values do not spread further.

Core Features & Use Cases

Critical blocking: Stops outputs containing live credentials like OpenAI keys, AWS keys, GitHub tokens, Stripe secrets, and PEM private keys.
Redaction and warnings: Masks high-severity matches and flags suspicious patterns such as bearer tokens, auth strings, and high-entropy secrets.
Post-tool-use protection: Works after a Bash command runs, which makes it ideal for diagnostics, container inspection, Kubernetes output, and any command that may print hidden secrets.

Quick Start

Ask the assistant to install this hook so every Bash command output is scanned for secrets, critical leaks are blocked, and suspicious values are redacted or flagged before they appear in chat.

Frequently Asked Questions about credential-leak-detector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent API keys and secrets from leaking in Bash command output?▼

Secret leak detection scans Bash command output during post-tool-use checks to block critical credentials like API keys and tokens before they reach the conversation.

Can I redact sensitive credentials like PEM private keys from terminal output automatically?▼

Yes, credential redaction masks high-severity matches such as PEM private keys and bearer tokens, replacing sensitive values with warnings before chat exposure.

What types of credentials does secret detection block in command line diagnostics?▼

Secret detection blocks live credentials including OpenAI keys, AWS keys, GitHub tokens, Stripe secrets, and PEM private keys found in command line output.

How does post-tool-use credential scanning work for Kubernetes and container inspection?▼

Post-tool-use credential scanning runs immediately after a Bash command executes, capturing Kubernetes or container output to flag hidden secrets before display.

Does this credential scanner require any external dependencies or security tools installed?▼

No external dependencies are required. The credential scanner operates as a standalone post-tool hook using regex pattern matching and severity-based blocking to redact secrets.

Why are bearer tokens and high-entropy strings flagged as suspicious during secret scanning?▼

Bearer tokens and high-entropy strings are flagged as suspicious because they frequently represent hidden authentication credentials or auth strings that pose security risks if exposed.