Can this skill be integrated into my CI/CD pipeline?

Yes, it provides specific YAML and shell script patterns to block pull requests or commits if secrets are detected during the build process.

What types of secrets can this skill detect?

The skill detects a wide range of credentials including AWS access keys, GitHub tokens, OpenAI keys, database connection strings, private keys, and high-entropy passwords.

What happens if a secret is found in my git history?

The skill identifies the specific commit and author, then provides remediation steps including key rotation and history cleanup using tools like git-filter-repo.

How does it handle false positives in documentation?

It features an allowlist management system (.secret-scan-allowlist.yml) where you can define legitimate exceptions for documentation examples or test placeholders.

Secret Scan Security Auditor

Name: Secret Scan Security Auditor
Author: marcel-Ngan

bymarcel-Ngan

•

セキュリティとテスト

Detects and prevents accidental exposure of sensitive credentials, API keys, and private keys within code repositories.

The Secret Scan skill provides a comprehensive security layer for Claude Code, identifying accidentally committed secrets, passwords, and tokens across various cloud providers and services. By utilizing both high-confidence pattern matching and Shannon entropy analysis, it detects high-risk exposures like AWS keys, database connection strings, and private certificates. This skill not only flags vulnerabilities but also provides structured remediation steps, CI/CD integration patterns, and incident response procedures to ensure your development lifecycle remains secure and compliant.

主な機能

011 GitHub stars

02Shannon entropy-based detection to identify high-randomness strings and non-standard passwords.

03Automated generation of structured scan reports with severity levels and remediation advice.

04Multi-provider pattern matching for AWS, GitHub, OpenAI, Stripe, and Google Cloud credentials.

05Integration-ready scripts for Git pre-commit hooks and CI/CD pipeline enforcement.

06Advanced allowlist management to minimize false positives in documentation and test environments.

ユースケース

01Conducting security audits on legacy repositories to identify and rotate exposed credentials.

02Automating pull request checks to prevent new secrets from being merged into production branches.

03Identifying and removing sensitive data from historical Git commits using recommended cleanup procedures.

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add marcel-ngan/ai-dev-team security

For use in Claude.ai and ChatGPT

Download Skill