Secrets Scan

Scans your codebase for hardcoded credentials like AWS keys, GitHub tokens, Stripe keys, private keys, and database passwords. You can run it on specific directories, enable entropy detection for unknown formats, or even scan git history for secrets that were committed and later removed. The pattern library covers major providers (AWS, GCP, Stripe, Slack, Twilio) with both high-confidence exact matches and fuzzier generic patterns. Output shows severity levels and remediation steps. The ignore system handles false positives in test fixtures and docs. Good for that moment when you realize someone might have committed real credentials, or before open sourcing a private repo.

skills.sh installs: 385
GitHub stars: 182
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add jwynia/agent-skills --skill secrets-scan --agent claude-code

Installs into .claude/skills of the current project.

Files

Secrets Scan

Deep detection of hardcoded credentials and sensitive data in source code.

Quick Start

/secrets-scan                    # Scan current directory
/secrets-scan --scope src/       # Scan specific path
/secrets-scan --entropy          # Include high-entropy detection
/secrets-scan --git-history      # Check git commit history

What This Skill Detects

High-Confidence Patterns

Patterns with very low false positive rates:

Type	Pattern Example	Provider
AWS Access Key	`AKIA...` (20 chars)	AWS
AWS Secret Key	40 char base64	AWS
GitHub Token	`ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_`	GitHub
GitLab Token	`glpat-...`	GitLab
Slack Token	`xoxb-`, `xoxp-`, `xoxa-`	Slack
Stripe Key	`sk_live_`, `rk_live_`	Stripe
Twilio	`SK...` (34 chars)	Twilio
SendGrid	`SG.` followed by base64	SendGrid
Private Key	`-----BEGIN (RSA\|EC\|DSA)?PRIVATE KEY-----`	Various
Google API Key	`AIza...` (39 chars)	Google