secret-scanning

Installation
SKILL.md

Secret Scanning Skill

Overview

This skill uses the GitHub MCP Server's run_secret_scanning tool to detect secrets in content, files, or git changes. It helps identify sensitive material like API keys, passwords, and credentials that could pose a security risk if exposed.

What counts as a secret?

In this context, values that grant access, impersonate a user or service, sign requests, or decrypt protected data are generally treated as secrets.

Treat these as high-confidence secret material:

  • Access tokens, API keys, and bearer credentials
  • Passwords, database DSNs with embedded credentials, and SMTP auth values
  • Private keys, signing keys, certificates with private key blocks, and SSH keys
  • OAuth client secrets, refresh tokens, and webhook secrets
  • Cloud credentials (AWS/GCP/Azure) and CI/CD deployment credentials

Prefer context, not just regex:

Related skills
Installs
39
GitHub Stars
248
First Seen
Mar 18, 2026