Detects hardcoded values, magic numbers, duplicate constants, and leaked secrets using Ruff, Semgrep, jscpd, and gitleaks. Use when auditing for hardcodes, magic numbers, PLR2004, constant detection, secret scanning, or before release.
/plugin marketplace add terrylica/cc-skills/plugin install terrylica-itp-plugins-itp@terrylica/cc-skillsThis skill is limited to using the following tools:
assets/semgrep-hardcode-rules.yamlreferences/output-schema.mdreferences/tool-comparison.mdreferences/troubleshooting.mdscripts/audit_hardcodes.pyscripts/run_gitleaks.pyscripts/run_jscpd.pyscripts/run_ruff_plr.pyscripts/run_semgrep.pyUse this skill when the user mentions:
# Full audit (all tools, both outputs)
uv run --script scripts/audit_hardcodes.py -- src/
# Python magic numbers only (fastest)
uv run --script scripts/run_ruff_plr.py -- src/
# Pattern-based detection (URLs, ports, paths)
uv run --script scripts/run_semgrep.py -- src/
# Copy-paste detection
uv run --script scripts/run_jscpd.py -- src/
# Secret scanning (API keys, tokens, passwords)
uv run --script scripts/run_gitleaks.py -- src/
| Tool | Detection Focus | Language Support | Speed |
|---|---|---|---|
| Ruff PLR2004 | Magic value comparisons | Python | Fast |
| Semgrep | URLs, ports, paths, credentials | Multi-language | Medium |
| jscpd | Duplicate code blocks | Multi-language | Slow |
| gitleaks | Secrets, API keys, passwords | Any (file-based) | Fast |
{
"summary": {
"total_findings": 42,
"by_tool": { "ruff": 15, "semgrep": 20, "jscpd": 7 },
"by_severity": { "high": 5, "medium": 25, "low": 12 }
},
"findings": [
{
"id": "MAGIC-001",
"tool": "ruff",
"rule": "PLR2004",
"file": "src/config.py",
"line": 42,
"column": 8,
"message": "Magic value used in comparison: 8123",
"severity": "medium",
"suggested_fix": "Extract to named constant"
}
],
"refactoring_plan": [
{
"priority": 1,
"action": "Create constants/ports.py",
"finding_ids": ["MAGIC-001", "MAGIC-003"]
}
]
}
src/config.py:42:8: PLR2004 Magic value used in comparison: 8123 [ruff]
src/probe.py:15:1: hardcoded-url Hardcoded URL detected [semgrep]
src/client.py:20-35: Clone detected (16 lines, 95% similarity) [jscpd]
Summary: 42 findings (ruff: 15, semgrep: 20, jscpd: 7)
--output {json,text,both} Output format (default: both)
--tools {all,ruff,semgrep,jscpd,gitleaks} Tools to run (default: all)
--severity {all,high,medium,low} Filter by severity (default: all)
--exclude PATTERN Glob pattern to exclude (repeatable)
--parallel Run tools in parallel (default: true)
code-clone-assistant - PMD CPD-based clone detection (DRY focus)This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.