Can this skill be integrated into my CI/CD pipeline?

Yes, it provides specific YAML and shell script patterns to block pull requests or commits if secrets are detected during the build process.

What types of secrets can this skill detect?

The skill detects a wide range of credentials including AWS access keys, GitHub tokens, OpenAI keys, database connection strings, private keys, and high-entropy passwords.

What happens if a secret is found in my git history?

The skill identifies the specific commit and author, then provides remediation steps including key rotation and history cleanup using tools like git-filter-repo.

How does it handle false positives in documentation?

It features an allowlist management system (.secret-scan-allowlist.yml) where you can define legitimate exceptions for documentation examples or test placeholders.

Secret Scan Security Auditor

Name: Secret Scan Security Auditor
Author: marcel-Ngan

bymarcel-Ngan

•

Security & Testing

Detects and prevents accidental exposure of sensitive credentials, API keys, and private keys within code repositories.

About

The Secret Scan skill provides a comprehensive security layer for Claude Code, identifying accidentally committed secrets, passwords, and tokens across various cloud providers and services. By utilizing both high-confidence pattern matching and Shannon entropy analysis, it detects high-risk exposures like AWS keys, database connection strings, and private certificates. This skill not only flags vulnerabilities but also provides structured remediation steps, CI/CD integration patterns, and incident response procedures to ensure your development lifecycle remains secure and compliant.

Key Features

1 GitHub stars
Shannon entropy-based detection to identify high-randomness strings and non-standard passwords.
Automated generation of structured scan reports with severity levels and remediation advice.
Multi-provider pattern matching for AWS, GitHub, OpenAI, Stripe, and Google Cloud credentials.
Integration-ready scripts for Git pre-commit hooks and CI/CD pipeline enforcement.
Advanced allowlist management to minimize false positives in documentation and test environments.

Use Cases

Conducting security audits on legacy repositories to identify and rotate exposed credentials.
Automating pull request checks to prevent new secrets from being merged into production branches.
Identifying and removing sensitive data from historical Git commits using recommended cleanup procedures.

About

Key Features

1 GitHub stars
Shannon entropy-based detection to identify high-randomness strings and non-standard passwords.
Automated generation of structured scan reports with severity levels and remediation advice.
Multi-provider pattern matching for AWS, GitHub, OpenAI, Stripe, and Google Cloud credentials.
Integration-ready scripts for Git pre-commit hooks and CI/CD pipeline enforcement.
Advanced allowlist management to minimize false positives in documentation and test environments.

Use Cases

Conducting security audits on legacy repositories to identify and rotate exposed credentials.
Automating pull request checks to prevent new secrets from being merged into production branches.
Identifying and removing sensitive data from historical Git commits using recommended cleanup procedures.