How does the Secret Scanner find keys not defined by standard patterns?

It uses entropy analysis to identify high-randomness strings that typically represent unique passwords, private keys, or custom tokens that don't follow a standard format.

Does it provide instructions on how to fix the security issues?

The skill generates a detailed report that includes specific remediation steps, such as revoking the compromised key and moving secrets to secure environment variables.

When is the best time to run a secret scan?

It is best practice to run a scan before every major commit, during code reviews, or whenever you are auditing a legacy repository for the first time.

Can I use this for AWS and Google Cloud keys?

Yes, the skill includes specific pattern matching for major cloud provider credentials including AWS Access Keys, Google Cloud APIs, and Azure tokens.

Secret Scanner

Name: Secret Scanner
Author: intent-solutions-io

byintent-solutions-io

Security & Testing

Identifies and remediates exposed API keys, passwords, and sensitive credentials within your codebase using advanced pattern matching and entropy analysis.

About

The Secret Scanner skill empowers Claude to proactively secure your repository by detecting hardcoded secrets before they reach version control or production environments. By combining regex-based pattern matching for known services like AWS or Google Cloud with high-entropy analysis for unique passwords and private keys, it provides a comprehensive security audit. This skill is essential for maintaining compliance, preventing unauthorized access, and automating the identification of sensitive data across configuration files, environment variables, and source code.

Key Features

Automated pattern matching for major cloud provider API keys
Entropy analysis to detect unique passwords and private keys
Support for scanning configuration files and environment variables
Detailed vulnerability reporting with specific file locations
Proactive remediation guidance for rotating exposed secrets
0 GitHub stars

Use Cases

Scanning legacy codebases for forgotten hardcoded passwords
Pre-commit security audits to prevent leaking credentials to version control
Auditing configuration files for sensitive data before cloud deployment

About

Key Features

Automated pattern matching for major cloud provider API keys
Entropy analysis to detect unique passwords and private keys
Support for scanning configuration files and environment variables
Detailed vulnerability reporting with specific file locations
Proactive remediation guidance for rotating exposed secrets
0 GitHub stars

Use Cases

Scanning legacy codebases for forgotten hardcoded passwords
Pre-commit security audits to prevent leaking credentials to version control
Auditing configuration files for sensitive data before cloud deployment