skills.rest
chadananda
chadanandaCOMMUNITY
Explore all skills by this author →
GitHub

security-scan

Detect API keys, tokens, and secrets in code, configs, and docs.

Updated Feb 6, 2026
Search Tags:#security#secrets#pre-commit#coder-agent#scanner#xswarm-ai-sanitize
One-click install
npx skills add https://github.com/chadananda/xswarm-tdd-claude --skill security-scan-chadananda
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scan
Source: https://github.com/chadananda/xswarm-tdd-claude/tree/main/skills/security-scan
Command: npx skills add https://github.com/chadananda/xswarm-tdd-claude --skill security-scan-chadananda

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill prevents leakage of API keys, tokens, and other secrets by automatically scanning code, configs, and docs before completion in coder-agent workflows.

Core Features & Use Cases

  • Automated secret detection: detects 600+ patterns using xswarm-ai-sanitize via npx, respects .gitignore, and can output JSON for CI.
  • Mandatory QA for coder agents: integrates as a required step before signaling implementation completion.
  • Pre-commit and workflow integration: supports zero-install scans and can be paired with pre-commit hooks for automatic checks.

Quick Start

Run an immediate security check with: npx xswarm-ai-sanitize detect .

Frequently Asked Questions about security-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan code for API keys and secrets before a Git commit?▼

To scan for secrets before a Git commit, you can use automated tools that detect API keys and tokens in code and configs. This skill runs automated secret detection via npx xswarm-ai-sanitize, supporting 607+ patterns to prevent leakage.

What is automated secret detection in a coder-agent workflow?▼

Automated secret detection in a coder-agent workflow is a mandatory QA step that scans code, configs, and documentation for API keys and tokens before signaling implementation completion. It prevents sensitive data leakage by applying 607+ secret patterns.

Can I use a pre-commit hook to prevent secrets from being committed to Git?▼

Yes, you can use a pre-commit hook to prevent secrets from being committed to Git. This skill supports pairing with pre-commit hooks and provides zero-install scanning via npx xswarm-ai-sanitize to automatically block sensitive data.

Does the secret scanner support JSON output for CI pipelines?▼

Yes, the secret scanner supports JSON output for CI pipelines. It relies on xswarm-ai-sanitize via npx to detect 607+ secret patterns, respects .gitignore files, and outputs structured JSON results for automated CI integration.

What's the best way to manually audit a repository for exposed tokens?▼

The best way to manually audit a repository for exposed tokens is running an immediate security check with npx xswarm-ai-sanitize detect. It scans code, configs, and docs across your repository using 607+ secret detection patterns.

Do I need to install dependencies to run a security scan for API keys?▼

No, you do not need to install dependencies to run a security scan for API keys. This skill relies on xswarm-ai-sanitize for zero-install scanning via npx, allowing you to run immediate security checks without permanent setup.

Related Skills

Explore More Software Engineering Skills→
slbugslbug
7

rb:secrets

Detect leaked secrets and exposed credentials in Ruby codebases.

Community
Intermediate
jiunbaejiunbae
12

security-auditor

Audit Git repositories for exposed secrets and sensitive data.

Community
Advanced
zapabobzapabob
2

specstory-guard

Install a Git pre-commit hook to scan `.specstory/history` files for secrets.

Community
Intermediate
adityaarsharmaadityaarsharma
2

orbit-sec-secrets-leak

Detect hardcoded secrets in WordPress plugins and git history.

Community
Advanced