sec-check

Audit codebases for hardcoded secrets and insecure configuration patterns.

Updated Mar 18, 2026
One-click install
npx skills add https://github.com/mikecubed/agent-orchestration --skill sec-check
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: sec-check
Source: https://github.com/mikecubed/agent-orchestration/tree/main/plugins/ccc/skills/sec-check
Command: npx skills add https://github.com/mikecubed/agent-orchestration --skill sec-check

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

Audits codebases to detect hardcoded secrets, insecure patterns, and misconfigurations, preventing security incidents and speeding remediation.

Core Features & Use Cases

  • Automated secret discovery and flagging across multiple languages and repositories.
  • Enforcement of SEC-1 through SEC-7 rules with actionable remediation guidance.
  • Integration with CI pipelines and code reviews to surface findings early in the development lifecycle.
  • Useful in incident response to review recent commits for credential leaks and risky configurations.

Quick Start

Run automated security scans by executing the scripts/scan_secrets.sh --path {scope} and review the resulting findings.

Frequently Asked Questions about sec-check

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my codebase for hardcoded secrets and insecure patterns?

To scan for hardcoded secrets and insecure patterns, execute the automated script scripts/scan_secrets.sh --path {scope} across your repository to detect vulnerabilities and review the resulting findings.

What security checks are enforced during a code audit?

A code audit enforces SEC-1 through SEC-7 rules, detecting hardcoded secrets, unsafe HTML/eval usage, and insecure configuration patterns while providing actionable remediation guidance and safe defaults.

Does the automated security scanner support Python, Go, and Rust codebases?

Yes, the security scanner supports Python, Go, Rust, TypeScript, and JavaScript codebases, auditing for hardcoded secrets and insecure configuration patterns across multiple languages.

Can I integrate automated secret scanning into CI pipelines and code reviews?

Yes, you can integrate automated secret scanning into CI pipelines and code reviews to surface hardcoded credentials and risky configurations early in the development lifecycle.

How do I review recent commits for credential leaks during incident response?

To review recent commits for credential leaks during incident response, run the automated scanning script against the affected scope to detect hardcoded secrets and insecure configurations.

What is the best way to detect unsafe eval usage and insecure configurations in my code?

The best way to detect unsafe eval usage and insecure configurations is running an automated security audit that flags vulnerabilities and provides actionable remediation guidance with safe defaults.