sast-hardcodedsecrets

Scan codebases for hardcoded secrets and write findings to markdown files.

1.3k|61|Updated Mar 30, 2026

Search Tags:#client-side #vulnerability-detection #hardcoded-secrets #security-scanning #code-security #public-code

Ready to run

npx skills add https://github.com/utkusen/sast-skills --skill sast-hardcodedsecrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: sast-hardcodedsecrets
Source: https://github.com/utkusen/sast-skills/tree/main/sast-files/.agents/skills/sast-hardcodedsecrets
Command: npx skills add https://github.com/utkusen/sast-skills --skill sast-hardcodedsecrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects hardcoded sensitive data (API keys, tokens, private keys, and passwords) that are exposed in publicly accessible code, helping teams locate credential leaks before they are exploited.

Core Features & Use Cases

Three-phase detection: recon, batched verify, and merge to surface authentic secrets in code bases across frontend, mobile, and server-linked projects.
Outputs to sast/hardcodedsecrets-recon.md during Recon and to sast/hardcodedsecrets-results.md after Phase 3
Prerequisites: sast/architecture.md must exist to map software stack and determine frontend vs backend exposure.

Quick Start

Initiate the recon phase to identify candidate secrets and review the resulting sast/hardcodedsecrets-recon.md to begin verification.

Frequently Asked Questions about sast-hardcodedsecrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find hardcoded secrets in public code?▼

Hardcoded secrets are sensitive credentials like API keys, tokens, and private keys embedded directly in source code. This Skill detects them across frontend and mobile configurations by scanning for exposed artifacts before they can be exploited.

What is the best way to scan client-side code for hardcoded API keys?▼

Scanning client-side code for hardcoded API keys is best handled by this Skill's three-phase workflow: recon, batched verify, and merge. It maps software stacks to determine frontend exposure and surfaces authentic secrets in the final results.

Do I need an architecture file to detect hardcoded secrets?▼

Yes, you need the sast/architecture.md file as a prerequisite to detect hardcoded secrets. This mapping file allows the Skill to understand your software stack and accurately determine frontend versus backend exposure before scanning begins.

How does the hardcoded secret detection workflow operate?▼

The hardcoded secret detection workflow operates in three phases: recon, batched verify, and merge. It initially writes candidate findings to sast/hardcodedsecrets-recon.md and then outputs final classified results to sast/hardcodedsecrets-results.md.

Can I use this to locate credential leaks in mobile app configurations?▼

Yes, you can use this to locate credential leaks in mobile app configurations. The Skill explicitly scans frontend, mobile, and client-side configurations to classify sensitive data artifacts and identify exposed credentials across these environments.