From ai-security-skills
Detects hardcoded credentials, API keys, tokens, and secrets in source code and configs using trufflehog, gitleaks, detect-secrets, and manual patterns. Use for pre-commit reviews, repo audits, and secret detection setup.
npx claudepluginhub cmaenner/agent-security-playbookThis skill uses the workspace's default tool permissions.
Detect hardcoded secrets by following the full procedure in `plays/tier1-code-analysis/secrets-scan.md`.
Scans code, git history, and configs for secrets like API keys, cloud credentials, private keys, and DB strings using regex, entropy, and context. Assesses severity and generates remediation reports.
This skill should be used when the user asks to "find hardcoded secrets", "audit for credential leaks", "check for API keys in code", "review secret scanning alerts", "rotate a leaked secret", or needs to detect hardcoded credentials, review secret handling patterns, or remediate exposed secrets.
Detects hardcoded secrets, API keys, credentials, tokens, and private keys in source code and git history using regex patterns for pentesting and code reviews.
Share bugs, ideas, or general feedback.
Detect hardcoded secrets by following the full procedure in plays/tier1-code-analysis/secrets-scan.md.
Run Automated Scanner — Use available tools in preference order:
trufflehog filesystem --directory=<path> --json (recommended)trufflehog git file://<repo> --json (includes git history)gitleaks detect --source=<path> --report-format=jsondetect-secrets scan <path> --all-filesManual Pattern Analysis — Search for high-confidence patterns:
AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.)://user:pass@host).env, docker-compose*.yml, *.tfvars, terraform.tfstate, kubeconfig, .npmrc, .pypircContextual Analysis — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?
Check Preventive Controls — Verify: .gitignore covers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.
Important: Never include actual secret values in findings. Show redacted versions only (e.g., AKIA****EXAMPLE). Active production secrets require immediate rotation.
Scan summary, findings using templates/finding.md, preventive controls checklist, and immediate rotation actions if needed.