Does this replace a dedicated security team?

While it is a powerful tool for automated detection, it is intended to augment your security workflow by catching common mistakes early in the development process.

What happens when a secret is detected?

The skill generates a detailed report highlighting the location of the secret and provides specific remediation steps, such as moving values to environment variables or revoking compromised keys.

How does the Secret Scanner find secrets?

The skill uses a combination of predefined pattern matching for known service keys and entropy analysis to identify high-randomness strings that likely represent obfuscated credentials.

Can it detect keys for specific cloud providers like AWS?

Yes, it includes specific detection patterns for major providers including AWS Access Keys, Google Cloud APIs, Azure secrets, and many others.

Is it safe to run on my entire repository?

Yes, the skill is designed to analyze your codebase to improve security, though users should ensure they have the necessary permissions to perform security audits on the target files.

Secret Scanner

Name: Secret Scanner
Author: Brmbobo

byBrmbobo

セキュリティとテスト

Detects and remediates exposed API keys, passwords, and sensitive credentials within your codebase to prevent security leaks.

概要

The Secret Scanner skill empowers Claude to proactively identify security vulnerabilities by scanning your codebase for hardcoded credentials, such as AWS keys, database passwords, and SSH private keys. Utilizing a combination of regex pattern matching and entropy analysis, it provides detailed reports on the exact location of exposed secrets and offers actionable remediation steps, ensuring sensitive information is removed or secured before being committed or deployed.

主な機能

Actionable remediation guidance for revoking and rotating keys
Configuration file auditing for .env, YAML, and JSON files
Entropy analysis to identify non-patterned sensitive strings
Automated detection of cloud provider API keys (AWS, Azure, GCP)
Detailed vulnerability reporting with specific file locations
0 GitHub stars

ユースケース

Auditing legacy repositories for accidentally committed credentials
Pre-deployment security checks to prevent secret leaks in production
Scanning environment configurations for hardcoded database passwords

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add brmbobo/web2podcast scanning-for-secrets

For use in Claude.ai and ChatGPT

Download Skill

GitHub

概要