Scan codebases for exposed secrets and API keys via MCP.
npx skills add https://github.com/endorlabs/skills-ideas --skill endor-secrets-endorlabs
Please help me install this Agent Skill. Skill: endor-secrets Source: https://github.com/endorlabs/skills-ideas/tree/main/skills/endor-secrets Command: npx skills add https://github.com/endorlabs/skills-ideas --skill endor-secrets-endorlabs
Exposed secrets, credentials, and API keys in codebases create serious security risks. This Skill detects sensitive data such as AWS keys, GitHub tokens, Stripe keys, and private keys to prevent leakage and potential compromise. It explicitly notes that it should not be used for code vulnerability scanning (/endor-sast) or dependency checks (/endor-sca).
Run a secrets scan on your project with the MCP tool and review the results.
High-intent search queries and answers about installing and using this skill.
To scan a codebase for exposed secrets, run a secrets scan via the MCP tool workflow. It identifies hardcoded tokens, private keys, and credentials across multiple file types in repositories, CI pipelines, and local development environments.
Secret scanning detects AWS Access Keys, AWS Secret Keys, GitHub Tokens, GitLab Tokens, Slack Tokens, Stripe Keys, Google API Keys, Private Keys, Database URLs, JWT Secrets, and common publishing tokens to prevent leakage.
To remediate leaked API keys, review the scan findings to identify exposed secrets, rotate the compromised credentials, and move sensitive data to environment-based secret management to prevent future leakage.
Secrets detection does not check for code vulnerabilities or dependency issues. Use dedicated SAST scanning for code vulnerabilities and SCA scanning for dependency checks, keeping secret detection focused on credential leakage.
You can scan for hardcoded tokens in CI pipelines and local development environments. The scanning supports multi-file type analysis across repositories to detect sensitive data like database URLs and JWT secrets.
The best way to prevent private keys from leaking is to scan codebases for sensitive data, rotate any found credentials, and implement environment-based secret management to securely store keys outside the source code.
zzw4257Scan git repositories for hardcoded secrets using the gitleaks binary.
JayRHaDetect, prevent, and remediate leaked credentials across codebases.
frogguguguguExecute SCA, SAST, DAST, and secret detection scans to report vulnerabilities.
williamzujkowskiMitigate security vulnerabilities from insecure NoSQL patterns in database environments.
