credential-scanner

To scan for exposed API keys and secrets, run this credential scanner in your project directory. It uses path-aware regex checks to identify sensitive patterns in files like .env and docker-compose.yml, providing a sanitized report with masked output and remediation suggestions.

Scanning for credentials prevents accidental exfiltration of sensitive information by other skills. It identifies and masks exposed API keys, private keys, and database URLs in your workspace, ensuring untrusted skills cannot inadvertently access or leak your secrets.

Yes, you can scan home directory files for exposed secrets. The scanner extends its scope beyond the project workspace to target common secret patterns in home directory files, but requires explicit consent before performing this broader scan.

A workspace scanner detects common secret patterns including API keys, private keys, database URLs, and generic password patterns. It targets sensitive information in configuration files like .env, docker-compose.yml, and private key files to prevent accidental exposure.

The credential scanner only reports exposed secrets and does not modify your files. It provides a sanitized report with masked output and remediation suggestions, allowing you to manually secure any detected credentials before running other skills.

Path-aware regex scanning works by applying skip rules and pattern checks to specific file paths in your project. It targets known secret-hiding files like .env and docker-compose.yml, efficiently detecting exposed credentials while skipping irrelevant paths.