Is entropy analysis accurate for finding secrets?

Entropy analysis is highly effective at finding non-standard secrets like unique passwords, though it may occasionally flag non-sensitive random strings which should be reviewed by the developer.

Which cloud providers are supported by the scanner?

The scanner includes patterns for major cloud providers including AWS, Google Cloud, Azure, and various third-party SaaS API key formats.

Does this skill automatically revoke or delete found secrets?

No, for safety reasons, the skill generates a detailed report and suggests remediation steps, such as revoking the key or moving it to an environment variable manager.

Can I use this skill to audit an entire existing repository?

Yes, you can trigger a full codebase scan by asking Claude to 'scan the repository for secrets' or 'check for exposed credentials'.

How does the Secret Scanner find hidden credentials?

It utilizes a combination of regex pattern matching for known service formats (like AWS keys) and entropy analysis to flag suspicious, high-randomness strings that often represent passwords or private keys.

Secret & Credential Scanner

Name: Secret & Credential Scanner
Author: BbgnsurfTech

byBbgnsurfTech

•

セキュリティとテスト

Scans codebases for exposed secrets, API keys, and credentials using pattern matching and entropy analysis to prevent security breaches.

概要

The Secret & Credential Scanner skill empowers developers to proactively secure their applications by identifying sensitive information accidentally hardcoded into source code. By leveraging advanced regex patterns for popular services like AWS and Google Cloud, alongside entropy analysis to detect high-randomness strings like private keys and passwords, this skill provides a critical safety net. It generates detailed reports highlighting the exact location of vulnerabilities and offers actionable remediation steps, making it an essential tool for maintaining repository hygiene and meeting security compliance standards.

主な機能

Detailed reporting with file paths and line numbers
Proactive remediation guidance for discovered leaks
3 GitHub stars
Automated detection of API keys for major cloud providers
Entropy-based analysis for identifying custom passwords
Support for various config formats including .env and YAML

ユースケース

Pre-commit security checks to prevent accidental data leaks
Auditing legacy repositories for hardcoded credentials
Identifying exposed private SSH or PGP keys in configuration

概要

主な機能

Detailed reporting with file paths and line numbers
Proactive remediation guidance for discovered leaks
3 GitHub stars
Automated detection of API keys for major cloud providers
Entropy-based analysis for identifying custom passwords
Support for various config formats including .env and YAML

ユースケース

Pre-commit security checks to prevent accidental data leaks
Auditing legacy repositories for hardcoded credentials
Identifying exposed private SSH or PGP keys in configuration