hf.scan-secrets-before-commit

Detect secrets in staged diffs and block commits on matches.

5|2|Updated Feb 18, 2026

Search Tags:#git #devops #security #pre-commit #secret-detection #secret-scan #code-security

Ready to run

npx skills add https://github.com/T-rav/hydraflow --skill hf-scan-secrets-before-commit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: hf.scan-secrets-before-commit
Source: https://github.com/T-rav/hydraflow/tree/main/.codex/skills/hf.scan-secrets-before-commit
Command: npx skills add https://github.com/T-rav/hydraflow --skill hf-scan-secrets-before-commit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams prevent accidental leakage of secrets by scanning staged changes for sensitive patterns before commit.

Core Features & Use Cases

Scans added lines in the staged diff for sensitive patterns and prevents commit if any are found.
Targets common secret formats (tokens, keys) and supports easy extension with new patterns.
Useful for protecting credentials in CI workflows and preventing accidental exposure in public repos.

Quick Start

When you attempt to commit changes, the skill scans staged diffs and blocks the commit if a secret pattern is detected.

Frequently Asked Questions about hf.scan-secrets-before-commit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I prevent secrets from leaking in a git pre-commit hook?▼

Secret detection in a pre-commit hook scans added lines in staged diffs for sensitive patterns like tokens and keys, blocking the commit if a match is found to prevent accidental credential exposure in your repositories.

Can I scan only staged changes for sensitive patterns before committing?▼

Yes, you can scan only staged changes by inspecting the added lines in the git diff. This secret detection approach targets common token and key formats, ensuring that only new or modified content is evaluated before the commit is allowed.

Do I need to define custom regex patterns for secret detection in code?▼

Yes, scanning staged changes for secrets requires a defined set of regex patterns to match sensitive formats. The skill targets common token and key formats by default and supports easy extension with new patterns for your specific credentials.

What happens when the pre-commit secret scan finds a match?▼

When the pre-commit secret scan finds a match in staged changes, it blocks the commit entirely and provides guidance to remove the detected secrets and renew the exposed keys before attempting to commit again.

Does secret scanning work for CI workflows and public repositories?▼

Yes, scanning staged diffs for secrets is highly useful for protecting credentials in CI workflows and preventing accidental exposure in public repos. It applies across software projects to inspect added lines in code, configs, and assets.