secret-scanning

Detect exposed secrets in files, snippets, and git diffs via GitHub MCP.

4|1|Updated Feb 19, 2026

Search Tags:#git #security #github #mcp #secrets #credentials #secret-scanning

Ready to run

npx skills add https://github.com/billlzzz26/visual-story-extension --skill secret-scanning

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-scanning
Source: https://github.com/billlzzz26/visual-story-extension/tree/main/.github/plugins/advanced-security/skills/secret-scanning
Command: npx skills add https://github.com/billlzzz26/visual-story-extension --skill secret-scanning

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps identify exposed secrets, credentials, and high-entropy values in files, code snippets, and git diffs to reduce the risk of accidental leaks and deployment failures.

Core Features & Use Cases

Content and File Scanning: Scan pasted text or specific repository files for likely secrets and return locations and confidence levels.
Git Diff / Staged Changes: Scan staged or recent diffs to catch secrets before commit or push.
MCP Integration: Uses the GitHub MCP Server's run_secret_scanning tool to perform server-side secret detection and produce structured findings.
Safety Practices: Includes guidance to avoid scanning large generated directories by default and to request user confirmation before scanning ignored or sensitive local files.

Quick Start

Scan the provided file or staged git changes for exposed secrets and return findings with file locations and remediation suggestions.

Frequently Asked Questions about secret-scanning

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan staged git diffs for exposed secrets before pushing code?▼

To scan staged git diffs for exposed secrets, provide the repository owner and name or file content inputs. The skill integrates with the GitHub MCP run_secret_scanning tool to produce location-tagged findings and confidence indicators for staged changes.

Can I use this to check a single code snippet for credentials?▼

Yes, you can scan single content snippets for credentials. The skill processes pasted text or specific repository files to identify likely secrets and returns their locations and confidence levels.

What is secret scanning with GitHub MCP and how does it work?▼

Secret scanning with GitHub MCP uses the run_secret_scanning tool to perform server-side detection of exposed credentials. It analyzes repository content, file inputs, or git diffs and returns structured findings with location tags and confidence indicators.

Do I need a specific repository setup to detect secrets in committed files?▼

You need to provide the repository owner and name or file content as inputs to detect secrets in committed files. The skill uses these inputs to run the GitHub MCP secret scanning tool and identify potential credential leaks in repository content.

What precautions should I take when scanning local files for secrets?▼

When scanning local files for secrets, avoid scanning large generated directories by default. The skill includes safety practices that require user confirmation before scanning ignored or sensitive local files to prevent unintended exposure or performance issues.

Does this approach catch high-entropy values in configuration files?▼

Yes, this approach catches high-entropy values in configuration files. The skill identifies exposed secrets, credentials, and high-entropy values in files, code snippets, and git diffs to reduce the risk of accidental leaks and deployment failures.