skills.rest
utkusen
utkusenCOMMUNITY
Explore all skills by this author →
Website𝕏@utkusen_enGitHub

sast-hardcodedsecrets

Scan codebases for hardcoded secrets and write findings to markdown files.

1.3k|61|Updated Mar 30, 2026
Search Tags:#client-side#vulnerability-detection#hardcoded-secrets#security-scanning#code-security#public-code
One-click install
npx skills add https://github.com/utkusen/sast-skills --skill sast-hardcodedsecrets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sast-hardcodedsecrets
Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-hardcodedsecrets
Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-hardcodedsecrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects hardcoded sensitive data (API keys, tokens, private keys, and passwords) that are exposed in publicly accessible code, helping teams locate credential leaks before they are exploited.

Core Features & Use Cases

  • Three-phase detection: recon, batched verify, and merge to surface authentic secrets in code bases across frontend, mobile, and server-linked projects.
  • Outputs to sast/hardcodedsecrets-recon.md during Recon and to sast/hardcodedsecrets-results.md after Phase 3
  • Prerequisites: sast/architecture.md must exist to map software stack and determine frontend vs backend exposure.

Quick Start

Initiate the recon phase to identify candidate secrets and review the resulting sast/hardcodedsecrets-recon.md to begin verification.

Frequently Asked Questions about sast-hardcodedsecrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find hardcoded secrets in public code?▼

Hardcoded secrets are sensitive credentials like API keys, tokens, and private keys embedded directly in source code. This Skill detects them across frontend and mobile configurations by scanning for exposed artifacts before they can be exploited.

What is the best way to scan client-side code for hardcoded API keys?▼

Scanning client-side code for hardcoded API keys is best handled by this Skill's three-phase workflow: recon, batched verify, and merge. It maps software stacks to determine frontend exposure and surfaces authentic secrets in the final results.

Do I need an architecture file to detect hardcoded secrets?▼

Yes, you need the sast/architecture.md file as a prerequisite to detect hardcoded secrets. This mapping file allows the Skill to understand your software stack and accurately determine frontend versus backend exposure before scanning begins.

How does the hardcoded secret detection workflow operate?▼

The hardcoded secret detection workflow operates in three phases: recon, batched verify, and merge. It initially writes candidate findings to sast/hardcodedsecrets-recon.md and then outputs final classified results to sast/hardcodedsecrets-results.md.

Can I use this to locate credential leaks in mobile app configurations?▼

Yes, you can use this to locate credential leaks in mobile app configurations. The Skill explicitly scans frontend, mobile, and client-side configurations to classify sensitive data artifacts and identify exposed credentials across these environments.

Related Skills

Explore More Software Engineering Skills→
ArianHobson333ArianHobson333
7

source-code-scanning

Automate source code security scanning for vulnerabilities, CVEs, and hardcoded secrets.

Community
Advanced
utkusenutkusen
1.3k

sast-report

Consolidate SAST findings from sast/*-results.md into a prioritized final-report.md.

Community
Intermediate
Nhqvu2005Nhqvu2005
54

security-scanner

Scan codebases for security vulnerabilities and generate a release checklist.

Community
Intermediate
Camilo8902Camilo8902

secrets-scanner

Detect leaked credentials in code repositories with Gitleaks, detect-secrets, and TruffleHog.

Community
Advanced