security-hygiene

Detect exposed secrets and insecure GitHub Actions configurations in repositories.

121|11|Updated Jan 22, 2026

Search Tags:#security #github actions #secrets #hygiene #code scanning #risk detection

Ready to run

npx skills add https://github.com/glaucia86/repocheckai --skill security-hygiene

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-hygiene
Source: https://github.com/glaucia86/repocheckai/tree/main/.github/skills/security-hygiene
Command: npx skills add https://github.com/glaucia86/repocheckai --skill security-hygiene

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill identifies basic security risks in repositories, such as exposed secrets, dangerous configurations, and insecure coding patterns, providing actionable recommendations with evidence.

Core Features & Use Cases

Secret Detection: Finds exposed secrets (tokens, keys, credentials) and suspicious files.
Configuration Review: Analyzes GitHub Actions for insecure permissions and usage of secrets.
Code Pattern Analysis: Detects potentially dangerous code patterns in Node.js/TypeScript.
Use Case: Before merging a pull request, run this skill to quickly scan for any accidentally committed API keys or overly permissive GitHub Actions workflows.

Quick Start

Use the security-hygiene skill to find exposed secrets and insecure GitHub Actions configurations in this repository.

Frequently Asked Questions about security-hygiene

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a repository for exposed secrets before merging a pull request?▼

To scan for exposed secrets before a merge, analyze repository contents to detect tokens, keys, and credentials. This skill inspects source code and suspicious files, generating actionable recommendations with evidence of the exposed secrets.

How do I check GitHub Actions workflows for insecure permissions and configurations?▼

Checking GitHub Actions for insecure permissions involves analyzing workflow files for dangerous configurations and secret usage. This skill reviews your CI/CD setup to identify overly permissive workflows and provides concise risk recommendations.

What insecure coding patterns can be detected in Node.js and TypeScript source code?▼

Insecure coding patterns detected in Node.js and TypeScript include dangerous configurations and vulnerable code structures. The skill analyzes source files and package.json to identify these risks, delivering evidence-based recommendations focused on severity and impact.

Can I detect dangerous configurations in CI/CD pipelines and scripts automatically?▼

You can detect dangerous configurations in CI/CD pipelines by analyzing GitHub Actions workflows and scripts. This skill inspects these files for insecure permissions and risky setups, outputting concise recommendations with evidence of the detected vulnerabilities.

What is the best way to identify security risks in GitHub Actions and package.json files?▼

The best way to identify security risks in GitHub Actions and package.json is to scan for exposed secrets, insecure permissions, and dangerous code patterns. This skill analyzes these files to generate evidence-based recommendations prioritized by severity.

Are there limitations when scanning for security risks in repositories using this approach?▼

A limitation of this repository security scan is its focus on basic security risks, targeting exposed secrets and dangerous configurations in Node.js, TypeScript, and GitHub Actions. It provides actionable recommendations but may not detect complex or language-specific vulnerabilities outside this scope.