Code Hardcode Audit

Runs a battery of nine static analysis tools to find hardcoded values, magic numbers, and leaked secrets in your codebase. It's overkill in a good way: combines Python-specific tools like Ruff PLR2004 and Bandit with language-agnostic scanners like ast-grep, Semgrep, TruffleHog for entropy detection, and Gitleaks for regex-based secret scanning. You get both JSON and compiler-style text output showing exactly where constants need extraction or credentials are exposed. Use it when you're doing a security audit, tracking down configuration that should be in environment variables, or just want to find all those mystery numbers scattered through the code. The preflight check is smart, the tool matrix is well documented, and it respects .gitignore so you won't scan node_modules for an hour.

skills.sh installs: 166
GitHub stars: 2
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add terrylica/cc-skills --skill code-hardcode-audit --agent claude-code

Installs into .claude/skills of the current project.

Files

Code Hardcode Audit

Self-Evolving Skill: This skill improves through use. If instructions are wrong, parameters drifted, or a workaround was needed — fix this file immediately, don't defer. Only update for real, reproducible issues.

When to Use This Skill

Use this skill when the user mentions:

"hardcoded values", "hardcodes", "magic numbers"
"constant detection", "find constants"
"duplicate constants", "DRY violations"
"code audit", "hardcode audit"
"PLR2004", "semgrep", "jscpd", "gitleaks", "ast-grep", "SSoT violations"
"secret scanning", "leaked secrets", "API keys", "bandit", "trufflehog", "whispers"
"passwords in code", "credential leaks", "entropy detection"
"config file secrets", "hardcoded credentials"

Quick Start

# Preflight — verify all tools installed and configured
uv run --python 3.14 --script scripts/preflight.py -- .

# Full audit (all 9 tools, preflight + both outputs)
uv run --python 3.14 --script scripts/audit_hardcodes.py -- src/

# Individual tools (all respect .gitignore):

# Python credential detection (passwords, tokens, API keys in variable names)
uv run --python 3.14 --script scripts/run_bandit.py -- src/

SKILL.md on GitHub