Secret Scanner Skill

This skill provides a multi-step workflow for scanning code, files, or git changes to detect leaked confidential information, including credentials, API keys, and Personally Identifiable Information (PII) like emails, phone numbers, and real names.

Recommended Scanning Workflow

The following guidelines outline a standard multi-step process for effectively scanning code for secrets:

Programmatic Scanning

When programmatic scanning is preferred or requested, tools like gitleaks or trufflehog should be used.

• For instructions on running or configuring these tools, consult references/programmatic_scanning.md.

Chunk/File Level Manual Analysis

When reviewing the content of a specified scope (e.g., staged git changes, unstaged changes, specific files), it helps to list all potential leak points first.

• To retrieve the content for the specified scope, consult references/scope_commands.md for shell commands.
• Look for:
  • Common Secrets: password, secret, token, api_key, access_key, jwt, private cryptographic keys.
  • Common PII: Electronic mail addresses (emails), phone numbers, real human names, physical addresses.
  • For a broader list of secret types and PII, consult references/secret_types.md.