security-secrets

Scan code repositories for secret patterns and sensitive data exposure.

Updated Feb 9, 2025

Search Tags:#security #secrets #api keys #redaction #code scanning #credential detection

Ready to run

npx skills add https://github.com/xeon826/dotfiles --skill security-secrets-xeon826

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-secrets
Source: https://github.com/xeon826/dotfiles/tree/main/opencode/skill/security-secrets
Command: npx skills add https://github.com/xeon826/dotfiles --skill security-secrets-xeon826

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill helps identify and prevent the accidental exposure of sensitive information like API keys, passwords, and tokens within your codebase, mitigating security risks.

Core Features & Use Cases

High-Signal Secret Detection: Utilizes a comprehensive set of regex patterns to find common secret formats.
Automated Scanning: Integrates with command-line tools like rg, gitleaks, semgrep, and trufflehog for thorough analysis.
Prioritized File Checking: Focuses scanning efforts on high-risk files such as .env files and configuration scripts.
Use Case: Proactively scan your entire repository before a security audit to ensure no hardcoded AWS keys or database credentials are committed.

Quick Start

Run a comprehensive scan for secrets in the current directory.

Frequently Asked Questions about security-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a code repository for hardcoded API keys and passwords?▼

To scan a code repository for hardcoded API keys and passwords, this Skill uses automated tools like ripgrep, gitleaks, semgrep, and trufflehog to locate sensitive data. It prioritizes high-risk files like .env files and configuration scripts to find and redact credentials.

What is the best way to detect and redact secrets in a CI/CD pipeline?▼

The best way to detect and redact secrets in a CI/CD pipeline is by applying automated scanning tools that identify high-signal secret patterns. This Skill integrates command-line utilities like gitleaks and trufflehog to analyze repository contents and prevent sensitive data exposure during security audits.

Do I need to install ripgrep, gitleaks, semgrep, and trufflehog to use this secret scanning functionality?▼

Yes, you need to install ripgrep, gitleaks, semgrep, and trufflehog because this Skill requires these command-line tools for automated secret detection and analysis. These dependencies enable the thorough scanning of code repositories for high-signal secret patterns and sensitive data exposure.

Can I automate AWS key detection and redaction before a security audit?▼

Yes, you can automate AWS key detection and redaction before a security audit by running a comprehensive scan on your current directory. This Skill proactively identifies and redacts credentials like API keys and tokens using comprehensive regex patterns and dedicated scanning tools.

How does high-signal secret detection work for .env files and configuration scripts?▼

High-signal secret detection works by applying comprehensive regex patterns alongside automated tools to prioritize scanning high-risk files like .env files and configuration scripts. This approach focuses scanning efforts on locations where API keys, tokens, and passwords are most commonly exposed.