Does it support entropy analysis?

Yes, it uses entropy analysis to identify potential secrets that don't follow standard patterns, such as custom tokens or high-randomness strings that might be credentials.

How do I trigger a secret scan with Claude?

You can initiate a scan by asking Claude to 'scan for secrets', 'find exposed keys', or 'check for credentials' within your project directory.

What types of secrets can this skill detect?

It detects a wide range of sensitive data including AWS/GCP/Azure keys, SSH private keys, PGP keys, database passwords, and generic API tokens via regex and entropy analysis.

Can it help me fix the security issues it finds?

Absolutely. The skill generates a detailed report that includes specific remediation steps and code examples to help you move secrets into environment variables or secure vaults.

Is this skill suitable for pre-commit checks?

Yes, you can use Claude to run this skill as part of your development workflow to proactively find secrets before committing changes to your version control system.

Secret Scanner

Name: Secret Scanner
Author: BbgnsurfTech

byBbgnsurfTech

•

Security & Testing

Identifies and remediates exposed secrets, API keys, and sensitive credentials within your codebase to prevent security breaches.

About

The Secret Scanner skill enhances Claude Code by providing automated detection of hardcoded credentials, private keys, and API tokens using advanced pattern matching and entropy analysis. It helps developers audit their repositories for accidental leaks, ensuring that sensitive information like AWS keys, database passwords, and SSH keys are identified before they are committed or deployed. By integrating seamlessly with Claude's file-handling capabilities, it offers a proactive layer of security that streamlines vulnerability management and ensures compliance with modern security standards.

Key Features

Pattern-based detection for major cloud providers like AWS, GCP, and Azure
Entropy analysis to identify unstructured secrets and high-randomness strings
Actionable remediation recommendations including code examples for secure storage
3 GitHub stars
Automated scanning of configuration files, environment templates, and scripts
Comprehensive reporting with precise file locations and severity levels

Use Cases

Scanning configuration files like .env or database.yml for hardcoded passwords
Reviewing code changes to identify accidentally staged private keys or tokens
Auditing a repository before making it public to ensure no API keys are exposed

About

Key Features

Pattern-based detection for major cloud providers like AWS, GCP, and Azure
Entropy analysis to identify unstructured secrets and high-randomness strings
Actionable remediation recommendations including code examples for secure storage
3 GitHub stars
Automated scanning of configuration files, environment templates, and scripts
Comprehensive reporting with precise file locations and severity levels

Use Cases

Scanning configuration files like .env or database.yml for hardcoded passwords
Reviewing code changes to identify accidentally staged private keys or tokens
Auditing a repository before making it public to ensure no API keys are exposed