skills.rest
Afaneor
AfaneorCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

secret-scanner

Detect hardcoded secrets in staged changes and block risky commits.

77|15|Updated Sep 4, 2022
Search Tags:#git#security#secrets#pre-commit#code-scanning#secret-scanner
One-click install
npx skills add https://github.com/Afaneor/fastapi-docker-boilerplate --skill secret-scanner-afaneor
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secret-scanner
Source: https://github.com/Afaneor/fastapi-docker-boilerplate/tree/main/%7B%7Bcookiecutter.project_name%7D%7D/.claude/skills/secret-scanner
Command: npx skills add https://github.com/Afaneor/fastapi-docker-boilerplate --skill secret-scanner-afaneor

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The Secret Scanner helps developers prevent leaking credentials by automatically detecting hardcoded API keys, passwords, tokens, and other secrets in code before they reach git. It reduces the risk of secret exposure during commits and collaboration.

Core Features & Use Cases

  • Pre-commit secret detection: Scans staged changes for sensitive patterns using a Bash-based hook.
  • Comprehensive pattern coverage: Detects common secret indicators such as API_KEY, SECRET, PASSWORD, TOKEN, and PRIVATE_KEY.
  • Mitigation guidance: Provides steps to move secrets to environment variables and .env files, and to update .gitignore and secret management practices.

Quick Start

  1. Add the PreToolUse hook as described in SKILL.md, ensuring your repository runs the secret scan on git commit.
  2. Create a sample test file with a secret pattern to verify the hook blocks the commit when secrets are present.
  3. Remove secrets from code, store them in environment variables, and re-run the commit test.

Frequently Asked Questions about secret-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect hardcoded secrets and API keys before a git commit?▼

A pre-commit hook scans staged changes for hardcoded secrets and API keys by grepping for sensitive patterns, then exits non-zero to block risky git commits automatically.

What types of sensitive patterns does a pre-commit secret scanner check for?▼

A pre-commit secret scanner checks staged changes for common sensitive patterns including API_KEY, SECRET, PASSWORD, TOKEN, and PRIVATE_KEY to prevent credential exposure in git.

Do I need any specific dependencies to run a Bash pre-commit hook for code scanning?▼

No external dependencies are required; the Bash-based pre-commit hook uses a PreToolUse mechanism to grep staged changes for secret patterns directly within your Git-based workflow.

How do I test if my pre-commit secret detection is working correctly?▼

To test pre-commit secret detection, create a sample file containing a dummy secret pattern, stage it, and attempt a git commit to verify the hook blocks the action.

What should I do with secrets after the pre-commit scan blocks my git commit?▼

After the pre-commit scan blocks your git commit, you should remove the hardcoded secrets from your code, store them in environment variables or .env files, and update your .gitignore practices.

Related Skills

Explore More Software Engineering Skills→
rnaarlarnaarla

git-guardrails-claude-code

Block dangerous git commands in Claude Code via a PreToolUse hook.

Community
Intermediate
dennisonbertramdennisonbertram
1

dotenv-audit

Scans .env files and code for exposed secrets and missing entries.

Community
Intermediate
Greenmamba29Greenmamba29

env-secrets-auditor

Scan environment files and codebases for exposed secrets and generate a remediation report.

Community
Intermediate
CsHengCsHeng
10

security-guardrails

Apply security guardrails for credential management and secret rotation across services.

Community
Advanced