Skip to main content
affpapa.org
RU EN
skill CX Codex

secrets-scan · owasp — Claude Code skill: find leaked secrets before commit

Scans source and config files for hardcoded credentials, API keys and tokens, whether you are reviewing before a merge or auditing a repo.

Install into Claude Code · Skills CLI (Vercel) All methods and platforms ↓ 
npx skills add OWASP/secure-agent-playbook --skill secrets-scan -a claude-code
Open on GitHub

What secrets-scan does

The skill runs an automated scanner first and falls back to manual pattern matching when none is available. Preference order is trufflehog filesystem --directory=<path> --json, trufflehog git file://<repo> --json (which covers git history), gitleaks detect --source=<path> --report-format=json, then detect-secrets scan <path> --all-files.

Manual analysis targets high-confidence patterns: AWS keys (AKIA...), OpenAI (sk-...), Anthropic (sk-ant-...), GitHub (ghp_...), Slack (xoxb-...), Stripe (sk_live_...), SendGrid (SG.), connection strings with embedded passwords, PEM private keys and JWT secrets. It also flags the files where leaks tend to hide: .env, docker-compose*.yml, *.tfvars, terraform.tfstate, kubeconfig, .npmrc, .pypirc.

Every hit then gets a context pass: is it a real credential or a test fixture, is it still active, which service and permissions are involved. Findings never carry the raw value, only redacted forms such as AKIA****EXAMPLE. Skip the scanner step and the whole job rests on manual patterns, so coverage narrows without trufflehog or gitleaks installed. The skill closes by checking preventive controls: whether .gitignore covers sensitive files, whether a pre-commit hook and CI scanning are in place.

What it helps with

  • catch hardcoded keys before they reach a commit
  • audit git history for credentials already pushed
  • judge the blast radius of a leaked key
  • confirm .env and similar files are gitignored
  • report findings without exposing the secret values

Example prompts for the agent

  • scan this repo for hardcoded secrets before I merge
  • check the git history for leaked API keys
  • run secrets-scan over the src/ directory

How to install secrets-scan

1Skills CLI (Vercel)

npx skills add OWASP/secure-agent-playbook --skill secrets-scan -a claude-code

2Manually: put the files in place

~/.claude/skills/secrets-scan/SKILL.md

Copy the whole skill folder; for one project use .claude/skills/secrets-scan/

Step by step, with commands for each platform: How to install skills in Claude Code: five ways

Questions about secrets-scan

How do I install secrets-scan in Claude?

Run npx skills add OWASP/secure-agent-playbook --skill secrets-scan -a claude-code. The skill lands at ~/.claude/skills/secrets-scan/SKILL.md.

What does secrets-scan do?

It detects hardcoded credentials, API keys and tokens in source code and configuration files. Each detection is checked for whether it is a real, active secret and how far it reaches.

Which scanners does the skill use?

trufflehog first, then gitleaks, then detect-secrets. With none of them installed it falls back to manual pattern analysis.

Source text

SKILL.md · CC-BY-4.0 
---
name: secrets-scan
description: Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.
license: CC-BY-4.0
---

# Secrets Scan

Detect hardcoded secrets by following the full procedure in `plays/secrets-scan.md`.

## Steps

1. **Run Automated Scanner** — Use available tools in preference order:
   - `trufflehog filesystem --directory=<path> --json` (recommended)
   - `trufflehog git file://<repo> --json` (includes git history)
   - `gitleaks detect --source=<path> --report-format=json`
   - `detect-secrets scan <path> --all-files`
   - If no scanner available, proceed with manual pattern analysis.

2. **Manual Pattern Analysis** — Search for high-confidence patterns:
   - AWS keys (`AKIA...`), OpenAI (`sk-...`), Anthropic (`sk-ant-...`), GitHub (`ghp_...`), Slack (`xoxb-...`), Stripe (`sk_live_...`), SendGrid (`SG.`)
   - Connection strings with embedded passwords (`://user:pass@host`)
   - Private keys (PEM headers), JWT secrets, database credentials
   - High-risk files: `.env`, `docker-compose*.yml`, `*.tfvars`, `terraform.tfstate`, `kubeconfig`, `.npmrc`, `.pypirc`

3. **Contextual Analysis** — For each detection: Is it real (not a placeholder/test fixture)? Is it active? What's the blast radius (service, permissions, prod vs dev, exposure duration)?

4. **Check Preventive Controls** — Verify: `.gitignore` covers sensitive files, pre-commit hooks for secret scanning, CI pipeline scanning, secrets management documentation.

**Important**: Never include actual secret values in findings. Show redacted versions only (e.g., `AKIA****EXAMPLE`). Active production secrets require immediate rotation.

## Output

Scan summary, findings using `templates/finding.md`, preventive controls checklist, and immediate rotation actions if needed.

## OWASP References

- A07:2021: Identification and Authentication Failures
- CWE-798: Use of Hard-coded Credentials
- CWE-312: Cleartext Storage of Sensitive Information

© OWASP · CC-BY-4.0 · OWASP/secure-agent-playbook

Similar skills

All skills for Security →

secrets-scan by other authors comes first.

secrets-scan jwynia This skill hunts for hardcoded API keys, passwords and tokens in source files. Useful before a push or when auditing a repo you did not write. CX Codex +1 372installs secrets-in-git-history UseOSINT A skill that teaches the agent to hunt API keys, tokens and identities in git history and on GitHub, not just in the checked-out tree. CX Codex +1 1,900installs secrets-audit briiirussell Finds leaked API keys across source code, Git history, and build artifacts while auditing secrets-management posture. CX Codex +1 456installs ghost-scan-secrets ghostsecurity Scans repositories for leaked API keys, tokens, and hardcoded credentials. Useful for pre-commit checks or auditing codebases for exposed secrets. CX Codex +1 4,400installs Next.js Security Scan sugarforever A skill that scans Next.js and TypeScript/JavaScript projects for XSS, injection flaws, auth holes and hardcoded secrets. Useful before you ship. CX Codex +1 553installs security-scan jwynia Scans a codebase for OWASP Top 10 flaws, hardcoded credentials and unsafe configs. Useful before a deploy or when reading unfamiliar code. CX Codex +1 471installs security boshu2 This skill reviews code, dependencies, secrets, and prompt surfaces for security risks. Use it for a pre-release review or a repository scan. CX Codex +1 1,400installs

From the same set4

web-security-review Audits web applications against OWASP Top 10 (2021) risks and produces a prioritized remediation roadmap. Useful for reviewing server code, framework setups, and web configurations. CX Codex +1 613installs api-security-review This skill runs an API through the OWASP API Security Top 10 (2023), covering auth, BOLA, SSRF and gateway config. Useful before a release or when auditing someone else's service. CX Codex +1 503installs code-review-security A skill that reviews code for vulnerabilities against OWASP Top 10 and ASVS, then reports findings with attack scenarios and fixed snippets. CX Codex +1 402installs

Project sponsors

Companies that keep this analytics open
Gold sponsor
Nutra.Club

Impressions, clicks and code copies — open statistics. We keep the numbers public for the same reason NeBlask itself is public. Become a sponsor