credential-scanner

Scan project workspaces for exposed credentials, API keys, and secrets.

70|10|Updated Feb 5, 2026

Search Tags:#security #secrets #credentials #api keys #scanning #exfiltration

Ready to run

npx skills add https://github.com/UseAI-pro/openclaw-skills-security --skill credential-scanner

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: credential-scanner
Source: https://github.com/UseAI-pro/openclaw-skills-security/tree/main/skills/credential-scanner
Command: npx skills add https://github.com/UseAI-pro/openclaw-skills-security --skill credential-scanner

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill prevents accidental exposure and exfiltration of sensitive credentials, API keys, and secrets within a project before any skill with file-read access is executed.

Core Features & Use Cases

Proactive Secret Detection: Scans common file locations and patterns for exposed secrets.
Customizable Scope: Allows scanning of the current workspace and optionally the home directory with consent.
Use Case: Before running a new, potentially untrusted OpenClaw skill that requires file read access, use this skill to ensure no API keys or passwords are inadvertently exposed in your project files, preventing a security breach.

Quick Start

Scan the current workspace for exposed secrets using the credential-scanner skill.

Frequently Asked Questions about credential-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my project workspace for exposed API keys and secrets?▼

To scan your project workspace for exposed API keys and secrets, run a pre-flight check that applies path-aware regex rules to identify sensitive credentials in files like .env and docker-compose.yml. This process generates a sanitized report highlighting any accidental exfiltration risks before execution.

When should I use a credential scanner in my development environment?▼

Use a credential scanner in your development environment or CI/CD pipelines before executing new, potentially untrusted skills that require file-read access. This proactive secret detection step prevents security breaches by ensuring no passwords or API keys are inadvertently exposed in your project files.

What types of files and patterns does pre-flight secret scanning check?▼

Pre-flight secret scanning checks common file locations and patterns for exposed credentials, specifically targeting files like .env, docker-compose.yml, and private key files. It utilizes path-aware regex checks and customizable skip rules to accurately identify sensitive data.

Can I customize the scanning scope to include my home directory?▼

Yes, you can customize the scanning scope to optionally include your home directory with explicit consent. By default, the scanner targets the current workspace, but expanding the scope ensures broader coverage for exposed credentials across your local development environment.

How does sanitized reporting work when secrets are detected?▼

Sanitized reporting works by flagging the exact locations of exposed credentials and API keys without dumping the actual sensitive values into the output logs. This mechanism ensures that the security scan results remain safe to read and share while alerting you to potential exfiltration risks.

Does credential scanning work with CI/CD pipelines?▼

Yes, credential scanning works effectively within CI/CD pipelines as a pre-flight security check. It scans project workspaces for secrets before any file-read access is granted to subsequent tasks, preventing accidental exfiltration of sensitive credentials during automated deployments.