secrets

Detect leaked credentials and secret-like content in git changes.

Updated Jan 8, 2026

Search Tags:#pattern matching #secrets scanning #credential detection #leaked credentials #interactive workflow #git pre-commit #.gitignore automation

Ready to run

npx skills add https://github.com/jabb4/dotfiles --skill secrets-jabb4

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/jabb4/dotfiles/tree/main/.claude/skills/secrets
Command: npx skills add https://github.com/jabb4/dotfiles --skill secrets-jabb4

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Secrets scanners prevent accidental leakage of sensitive credentials into git by identifying risky filenames and secret-like content before changes land in your repository history.

Core Features & Use Cases

Sensitive-file detection: Flags common secret filenames (for example .env variants and key/certificate-related files), even when they are newly created or currently tracked.
Content pattern scanning: Searches text for well-known credential formats such as AWS keys, GitHub tokens, Stripe keys, JWTs, and private key blocks, including line-numbered matches.
Suspicious assignment review: Identifies likely secret-bearing variable assignments (e.g., password/token/api_key) with heuristics to reduce obvious placeholders and false positives.
Interactive decision workflow: Prompts per finding to either add targeted entries to .gitignore (and untrack when already tracked), ignore, or abort so you can handle real leaks safely.

Quick Start

Run the secrets skill on your pending changes by invoking /commit so it scans staged content and asks what to do about each potential secret before anything is committed.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan staged git changes for leaked credentials before committing?▼

Scan staged changes for leaked credentials by running a pre-commit check that enumerates candidate files, flags risky filenames, and searches content for well-known secret formats like AWS keys and JWTs.

What types of secrets and credentials can a git working tree scanner detect?▼

A git working tree scanner detects sensitive filenames like .env variants, credential patterns such as AWS keys, GitHub tokens, Stripe keys, JWTs, private key blocks, and suspicious variable assignments like password or api_key.

Can I automatically update .gitignore when a secret is found in my repository?▼

Yes, you can update .gitignore when a secret is found by using an interactive workflow that prompts per finding, allowing you to add targeted entries to .gitignore and untrack already tracked files.

How do I perform a standalone audit of my repository for leaked secrets?▼

Perform a standalone repository audit for leaked secrets by scanning the git working tree, which enumerates candidate files via git status and ls-files, then reviews filenames, content patterns, and suspicious assignments.

How are false positives handled when detecting suspicious variable assignments?▼

False positives during suspicious variable assignment detection are reduced using heuristics that filter out obvious placeholders, prompting per finding with options to ignore, abort, or update .gitignore for safe handling.