/secret-scan

Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.

BOOST

archive228@archive228

GitHub

From plugin

loopkit

75553 skills1 agent4 commands2 MCP

Install

$ npx -y skills add Archive228/loopkit --skill secret-scan --agent claude-code

How it fires

How this skill gets triggered: by you, by Claude, or both.

Fires itselfAuto-invocation. Claude auto-loads it when your prompt matches the work.
You can call itInvoke it directly when you want it.
Slash command/secret-scan

Context preview

The summary Claude sees to decide when to auto-load this skill.

Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.

SKILL.md

secret-scan.SKILL.md

name: secret-scan
description: Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.
when_to_use: before commit, files with API keys, .env handling, config, connection strings

Secret Scan

Grep the diff for: `api[_-]?key`, `secret`, `token`, `password`, `BEGIN PRIVATE KEY`, `AKIA[0-9A-Z]{16}`, `sk-`, `ghp_`, bearer values, and long base64/hex blobs. For each hit: is it a real secret or a placeholder? Real secrets: 1. Must move to env / a secrets manager — never the repo. 2. If already committed, it is COMPROMISED. Rotate it, don't just delete the line. 3. Add the pattern to `.gitignore` / a pre-commit secret scanner. Output: file:line of every real secret + the rotation step. A deleted secret in git history is still leaked.

Read it on GitHub ↗

Ships withloopkit

33 battle-tested skills + minimal .claude harness for any coding agent (Claude Code, Cursor, Codex, Gemini CLI).

Get the whole plugin

Stats

Node Bash SQL Git GitHub

+4 tags

Markdown Anthropic Gemini MCP

755

Stars

124

Forks