Can it tell if a secret is actually valid?

Yes, when using tools like TruffleHog, the skill can attempt to verify if detected credentials (like AWS keys) are still active and usable.

How do I fix a found secret?

The skill provides a Remediation Playbook that guides you through rotating the compromised key and properly removing it from your Git history using tools like BFG Repo-Cleaner.

Does this scan my entire Git history?

Yes, by using the --history or --all flags, the skill can scan every commit in your repository's history to find secrets that were deleted but remain in the logs.

Which tools does the Secrets skill require?

It prefers TruffleHog or Gitleaks for high accuracy but can fall back to advanced Grep-based pattern matching if no external tools are installed.

Secrets Scanner & Remediation

Name: Secrets Scanner & Remediation
Author: onesmartguy

byonesmartguy

0•

安全与测试

Scans codebases and Git history for exposed credentials, API keys, and sensitive tokens with automated remediation guidance.

The Secrets detection skill is a robust security auditing tool for Claude Code that identifies leaked credentials across 700+ service types, including AWS, GitHub, and Slack. it performs deep scans of both current files and historical Git commits, utilizing industry-standard tools like TruffleHog and Gitleaks or falling back to advanced regex patterns. By classifying findings by severity and verifying active leaks, it helps developers prevent security breaches and maintain compliance with secure coding standards.

主要功能

01Automated severity classification from Critical to Low confidence

02Detailed remediation playbooks and step-by-step rotation guidance

03Deep Git history scanning to find committed but deleted secrets

04Support for 700+ secret types via TruffleHog and Gitleaks integration

05Real-time verification of detected credentials to identify active risks

060 GitHub stars

使用场景

01Pre-commit security audits to prevent sensitive data from reaching production

02Incident response for identifying the scope of a credential leak in Git history

03Compliance checking for SOC2 or HIPAA security requirements

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add onesmartguy/raptor-claude-plugins secrets

For use in Claude.ai and ChatGPT

Download Skill