security-check-secrets

Scan code, configuration, and environment files for exposed credentials and secrets.

Updated Dec 23, 2025

Search Tags:#security #secrets #credentials #regex #CI #code scanning

Ready to run

npx skills add https://github.com/yaochangyu/ai-dev-toolkit --skill security-check-secrets

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-check-secrets
Source: https://github.com/yaochangyu/ai-dev-toolkit/tree/main/.github/skills/security-check-secrets
Command: npx skills add https://github.com/yaochangyu/ai-dev-toolkit --skill security-check-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill helps teams prevent credential leakage by scanning code, configuration files, and environment setups for hard-coded secrets such as API keys, passwords, tokens, and credentials.

Core Features & Use Cases

Secret detection: Finds hard-coded secrets in source files, configs, and environment files.
Pre-commit & CI checks: Integrates into workflows to stop leaks before commits or pushes.
Audit-ready reports: Generates structured findings that can be reviewed by security teams.
Use Case: Before merging a feature branch, run this Skill to ensure no secrets are present in new changes and, if found, fail the build and prompt remediation.

Quick Start

Run the scanning command on the target paths.
Review the generated report.
Remediate any findings and commit fixes.

Frequently Asked Questions about security-check-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my code for hard-coded secrets and API keys?▼

To scan code for hard-coded secrets, target your source files, configs, and environment files to detect exposed credentials. This process applies regex-based patterns to identify API keys, passwords, and tokens, generating structured reports for review.

Can I integrate secret detection into my CI pipelines and pre-commit checks?▼

Yes, you can integrate secret detection into CI pipelines and pre-commit checks to stop credential leaks before commits. Running this scan on feature branches ensures no secrets are present in new changes, failing the build if leaks are found.

What is the best way to audit configuration files for exposed credentials?▼

The best way to audit configuration files for exposed credentials is running automated regex-based pattern matching. This generates audit-ready structured reports detailing leaked secrets, allowing security teams to review findings and guide prompt remediation.

Does regex-based code scanning work for periodic repo security audits?▼

Regex-based code scanning works effectively for periodic security audits across entire repositories. It automates the detection of hard-coded secrets in source files and environment setups, producing structured findings to ensure continuous credential leak prevention.

What types of secrets can be detected in environment files?▼

Secrets detected in environment files include hard-coded API keys, passwords, tokens, and general credentials. The scan applies regex-based patterns to these configurations to identify exposed sensitive data and generate remediation guidance.

How do I remediate findings after a secret leak scan?▼

To remediate findings after a secret leak scan, review the generated structured report detailing exposed credentials. Remove the hard-coded secrets from your source files or configs, apply proper environment variable management, and commit the fixes.