Secrets Scanner

When to use

This skill covers three scenarios: an active leak (incident), preventive scanning, and setting up prevention. The action order differs sharply per scenario, so phase 1 explicitly asks which one you're doing.

Triggers:

• "I think I accidentally committed a key", "this token looks like it's leaking", "check whether there are secrets in the repo".
• A PR touches files like .env, .env.*, config/*.yaml, docker-compose*.yml, helm/values*.yaml, *.pem, *.key, credentials.json, or new files under secrets/, vault/.
• Setup of a new repo: install pre-commit plus CI secret-gate.
• Periodic audit of git history on an existing repo.
• A finding from security-review phase 3 (automated scan) that needs further triage.
• Anthropic/OpenAI-style token patterns in logs, screenshots, or shared notebooks.

When NOT to use (handoff)