skills.rest
florianbuetow
florianbuetowCOMMUNITY
Explore all skills by this author →
Website𝕏@bytetweetsGitHub

secrets

Scans source code, configuration files, and git history for hardcoded credentials, API keys, tokens, and private keys.

12|1|Updated Feb 9, 2026
Search Tags:#security#vulnerability#secrets#credentials#api keys#code scanning
One-click install
npx skills add https://github.com/florianbuetow/claude-code --skill secrets-florianbuetow
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/florianbuetow/claude-code/tree/main/plugins/appsec/skills/secrets
Command: npx skills add https://github.com/florianbuetow/claude-code --skill secrets-florianbuetow

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill automatically detects and flags hardcoded secrets, credentials, API keys, and other sensitive information within your codebase, preventing accidental exposure and potential security breaches.

Core Features & Use Cases

  • Comprehensive Scanning: Analyzes source code, configuration files, and git history for various types of secrets.
  • Contextual Analysis: Identifies secrets based on patterns, variable names, and file types.
  • Use Case: Before committing code, run this Skill to ensure no API keys or database passwords are accidentally included, safeguarding your application's security.

Quick Start

Use the secrets skill to scan the current directory for any hardcoded credentials.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan source code for hardcoded secrets and API keys?▼

To scan source code for hardcoded secrets, this Skill analyzes your files and git history to detect exposed API keys, tokens, and private keys. It identifies sensitive information using detection patterns, variable names, and file types.

What types of credentials can a code scanner detect in configuration files?▼

A code scanner detects cloud provider keys, service-specific tokens, passwords, private keys, and high-entropy strings. It comprehensively checks source code, .env files, configuration files, and git history for these hardcoded credentials.

Can I use gitleaks and trufflehog to find passwords in git history?▼

Yes, you can use gitleaks and trufflehog alongside trivy to find passwords in git history. This Skill integrates with these scanners to provide enhanced detection of hardcoded secrets and credentials across your codebase.

How do I check for exposed environment variables before committing code?▼

To check for exposed environment variables before committing, run this Skill to scan the current directory. It analyzes .env files and configuration files to ensure no database passwords or API keys are accidentally included.

What is the best way to detect high-entropy strings and private keys in a repository?▼

The best way to detect high-entropy strings and private keys is using contextual analysis. This Skill scans source code and git history, identifying secrets based on variable names, file types, and specific cloud provider key patterns.

Related Skills

Explore More Software Engineering Skills→
cwinvestmentscwinvestments
412

memstack-security-secrets-scanner

Scan source code and git history for hardcoded secrets and leaked API keys.

Community
Intermediate
igbuendigbuend
8

gitleaks

Detect hardcoded secrets in source code and Git history using Gitleaks.

Community
Intermediate
Logos-LiberLogos-Liber
17

vulnerability-scanning

Identifies security vulnerabilities in code, dependencies, and container images.

Official
Advanced
balsm-healthbalsm-health
2

implementing-secrets-scanning-in-ci-cd

Automate hardcoded secret detection in CI/CD pipelines with gitleaks and trufflehog.

Official
Advanced