Claude MarketplacesSubmit
useai-pro avatar

Credential Scanner

useai-pro/openclaw-skills-security

Runs a regex-based scan across your workspace to catch exposed API keys, database credentials, and private keys before file-reading skills get access. It checks .env files, config JSONs, docker-compose, and common secret patterns like AWS keys, OpenAI tokens, and SSH keys, then reports findings with masked values and specific cleanup steps. The real value is the triage: it differentiates between committed secrets (critical) and local-only files (warnings), and escalates everything if you're about to run a skill with network access. Skips node_modules and test fixtures, won't scan your home directory without consent. Think of it as a preflight check that prevents the "oh no, did that skill just see my .env" moment.

skills.sh installs
539
GitHub stars
74
last updated
Aug 21, 2026
View on GitHub

Install

$ npx -y skills add useai-pro/openclaw-skills-security --skill credential-scanner --agent claude-code

Installs into .claude/skills of the current project.

Files

Credential Scanner

You are a credential scanner for OpenClaw projects. Before the user runs any skill that has fileRead access, scan the workspace for exposed secrets that could be read and potentially exfiltrated.

What to Scan

High-Priority Files

Default scope: current workspace only. Scan project-level files first:

  • .env, .env.local, .env.production, .env.*
  • docker-compose.yml (environment sections)
  • config.json, settings.json, secrets.json
  • *.pem, *.key, *.p12, *.pfx

Home directory files (scan only with explicit user consent):

  • ~/.aws/credentials, ~/.aws/config
  • ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.ssh/config
  • ~/.netrc, ~/.npmrc, ~/.pypirc

Patterns to Detect

Scan all text files for these patterns:

SKILL.md on GitHub

Sponsors

Promote your product hereReach 125k+ visitors monthlyPromote your product hereReach 125k+ visitors monthlyAgent CaffeineSponsoredClose your lid, come back to finished workSnugSponsoredThe clipboard manager for the AI eraPromote your product hereReach 125k+ visitors monthlyWaxSponsoredBlock anything with supervision, without erasing your iPhonePromote your product hereReach 125k+ visitors monthlyknobsSponsoredSee your site on any phone, any day, in any language

Details

Repository
github.com/useai-pro/openclaw-skills-security
Categories
Backend & APIs, Security
First seen
Jun 3, 2026

More from useai-pro/openclaw-skills-security

All 13

Recommended

More Backend & APIs
1hkuds avatarcli-anything-videocaptionerhkuds/cli-anythingAI-powered video captioning — transcribe speech, optimize/translate subtitles, and burn them into video via the stable VideoCaptioner backend. Free ASR and tran537skills.sh installs
2intellectronica avatarcopilot-sdkintellectronica/agent-skillsThis skill helps with GitHub Copilot SDK work across Node.js/TypeScript, Python, Go, .NET, and Java. It covers setup, authentication, permissions, streaming eve535skills.sh installs
3vercel-labs avatarvercel-deployvercel-labs/agent-skillsDeploy applications and websites to Vercel. Use this skill when the user requests deployment actions such as "Deploy my app", "Deploy this to production", "Crea534skills.sh installs
4aj-geddes avatarsql-injection-preventionaj-geddes/useful-ai-promptsPrevent SQL injection attacks using prepared statements, parameterized queries, and input validation. Use when building database-driven applications securely.533skills.sh installs
5aj-geddes avatarmicroservices-architectureaj-geddes/useful-ai-promptsDesign and implement microservices architecture including service boundaries, communication patterns, API gateways, service mesh, service discovery, and distrib527skills.sh installs
6longbridge avatarlongbridge-security-listlongbridge/skillsUS overnight-eligible securities directory and HK broker participant directory via Longbridge Securities. `security-list` covers the US overnight-trading catalo524skills.sh installs