← LeaderboardThe Skill Leaderboard

smart-secrets-scanner

Intelligent secrets detection and prevention — scan code, configs, and git history for exposed API keys, passwords, tokens, and credentials

Published by LeoYeAI ↗LeoYeAI/agent-master-skills

Try your first task

A source-grounded starter task has not been verified for this skill yet.

SKILL.md

description: Intelligent secrets detection and prevention — scan code, configs, and git history for exposed API keys, passwords, tokens, and credentialskeywords: openclaw, skill, automation, ai-agent, secrets, scanner, security, credential, api-key, token-detection, leak-preventionname: smart-secrets-scannertriggers: secrets scanner, credential leak, API key detection, token exposure, security scan, secret detection

smart-secrets-scanner

Intelligent secrets detection — scan code, configs, and git history for exposed API keys, passwords, tokens, and credentials before they leak.

Skill Metadata

  • Slug: smart-secrets-scanner
  • Version: 1.0.0
  • Description: Intelligent secrets and credential scanner for codebases. Detects exposed API keys, passwords, tokens, private keys, and credentials in source code, config files, environment variables, and git commit history. Provides auto-remediation suggestions.
  • Category: security
  • Trigger Keywords: secrets scanner, credential leak, API key detection, token exposure, security scan, secret detection, git secret

Capabilities

1. Scan Current Project

```bash node scanner.js scan ./src node scanner.js scan ./ --include ".js,.json,.yaml,.env*" ``` Detects 50+ patterns: AWS keys, GitHub tokens, Slack webhooks, database URLs, private keys, JWTs, etc.

2. Scan Git History

```bash node scanner.js git-scan --depth 50 node scanner.js git-scan --since "2024-01-01" ``` Finds secrets that were committed and later removed (still in git history).

3. Pre-commit Hook

```bash node scanner.js hook --install

Now every commit is scanned automatically

```

4. Auto-Redact

```bash node scanner.js redact ./src/config.js --replace-with "[REDACTED]" ``` Replace detected secrets with placeholder values.

Detection Patterns

CategoryExamples
Cloud KeysAWS_ACCESS_KEY, GCP_SERVICE_ACCOUNT, AZURE_CLIENT_SECRET
API TokensGitHub, Slack, Stripe, OpenAI, Anthropic, Google Maps
DatabaseMongoDB URI, PostgreSQL URL, Redis password
CryptoRSA private key, SSH key, certificate
App SecretsJWT secret, session key, encryption key
Config Files.env, .npmrc, .pypirc, credentials.json

Use Cases

  1. CI/CD Pipeline: Block deployments with exposed secrets
  2. Pre-commit: Prevent secrets from entering git history
  3. Audit: Scan existing codebase for leaked credentials
  4. Compliance: SOC2, GDPR requirement for credential management
  5. Education: Teach developers about secret management

Output Format

```json { "findings": [ { "file": "src/config.js", "line": 12, "type": "AWS_ACCESS_KEY", "severity": "CRITICAL", "matched": "AKIAIOSFODNN7EXAMPLE", "suggestion": "Move to environment variable or secrets manager" } ], "summary": { "critical": 1, "high": 0, "medium": 2, "low": 5 } } ```