secret-scan

What this skill does

Detects API keys, passwords, tokens, and private keys in source code and git history using trufflehog or gitleaks. Classifies discovered secrets by type and provides remediation recommendations.

When to use

• Before publishing code to a public repository to check for secret leaks
• During security audits to detect hardcoded credentials in source code
• During incident response to check git history for past secret exposures
• In CI/CD pipelines to automatically block commits containing secrets

Prerequisites