skills.rest
robotijn
robotijnCOMMUNITY
Explore all skills by this author →
GitHub

secrets-detector

Detect hardcoded secrets across source code, git history, and container images.

3|2|Updated Jan 23, 2026
Search Tags:#secrets detection#credential scanning#remediation guidance#git history audit#live secret verification#SARIF output#container secret scan
One-click install
npx skills add https://github.com/robotijn/ctoc --skill secrets-detector-robotijn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-detector
Source: https://github.com/robotijn/ctoc/tree/main/skills/security/secrets-detector
Command: npx skills add https://github.com/robotijn/ctoc --skill secrets-detector-robotijn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill eliminates the critical risk of hardcoded, leaked, or exposed secrets across source code, git history, infrastructure-as-code, container images, and CI artifacts that can lead to data breaches, unauthorized access, financial loss from AI provider key abuse, and compliance violations.

Core Features & Use Cases

  • Multi-layer secret detection: Combines pattern matching, entropy analysis, and live upstream verification to catch known and custom secrets with high confidence.
  • Full transitive surface scanning: Scans not just the working tree, but also git history, Docker image layers, IaC modules, lockfiles, and CI logs to find secrets that were deleted but never purged.
  • Prioritized remediation guidance: Provides step-by-step rotation procedures for every major provider (AWS, GCP, Azure, Stripe, GitHub, AI providers) and git history rewrite instructions to remove exposed secrets from public history.
  • Use Case: A development team preparing for a production release can use this Skill to scan their entire repository and git history for accidentally committed API keys, cloud credentials, and private keys, verify which are still active, and follow the provided rotation steps to eliminate breach risk before deployment.

Quick Start

Use the secrets-detector skill to scan your repository, full git history, and container images for leaked credentials, verify which are still active, and receive prioritized remediation and rotation guidance for each finding.

Frequently Asked Questions about secrets-detector

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan git history for leaked secrets and API keys?▼

Scanning git history for leaked secrets requires pattern matching and entropy analysis across full commit trees. This skill checks historical commits, working trees, and lockfiles to find deleted but unpurged credentials, verifying which ones are still active.

What is live secret verification and how does it work for exposed cloud credentials?▼

Live secret verification tests discovered credentials against upstream providers like AWS, GCP, and Azure to confirm they are still active. This prevents wasted remediation effort on expired or invalidated keys during a credential scanning audit.

Does this credential scanning tool support SARIF output for GitHub Security tab aggregation?▼

Yes, this credential scanning tool supports SARIF output for GitHub Security tab aggregation. It integrates with TruffleHog, Gitleaks, and GitHub Secret Scanning to centralize findings directly within your repository's security interface.

How do I find and remove exposed secrets from Docker container image layers?▼

Finding and removing exposed secrets from Docker container image layers requires scanning each layer's filesystem and metadata. This skill scans container images and CI artifacts to detect hardcoded keys before deployment.

What is the best way to get remediation guidance for rotating leaked infrastructure-as-code secrets?▼

The best way to get remediation guidance for leaked infrastructure-as-code secrets is using a scanner that provides step-by-step rotation procedures. This skill outputs prioritized rotation steps for major providers and git history rewrite instructions.

Related Skills

Explore More Software Engineering Skills→
uphiagouphiago
1.1k

hunt-cicd

Detect critical CI/CD pipeline vulnerabilities across GitHub Actions, GitLab CI, Jenkins, and Terraform.

Community
Advanced
igbuendigbuend
8

gitleaks

Detect hardcoded secrets in source code and Git history using Gitleaks.

Community
Intermediate
statick88statick88
1

security-scanning

Automate security scanning for JavaScript and Python projects.

Community
Advanced
thanhquan3010thanhquan3010

springboot-verification

Automates build, static analysis, testing with coverage, vulnerability scanning and secret detection for Spring Boot projects.

Community
Advanced