Skill: nirwandogra/credential-scanner (version 0.1.0)

--- name: secret-scanner description: Scans files, repos, and directories for leaked secrets — API keys, tokens, passwords, connection strings, private keys, and credentials. Detects 40+ secret patterns across all major cloud providers and services. version: 0.1.0 --- # Secret Scanner Security skill that scans code, config files, and repos for accidentally leaked secrets and credentials. ## When to Use This Skill Use this skill when the user: - Asks to "check for leaked secrets" or "scan for API keys" - Wants to audit a repo or folder before committing or publishing - Says "are there any hardcoded passwords in this code?" - Asks to "find credentials" or "check for exposed tokens" - Wants pre-commit or pre-publish security checks - Mentions concern about accidentally checking in secrets ## Capabilities - Detect **40+ secret patterns** including: - AWS Access Keys, Secret Keys, Session Tokens - Azure Storage Keys, Connection Strings, SAS Tokens - GCP Service Account Keys, API Keys - GitHub / GitLab / Bitbucket Personal Access Tokens - OpenAI, Anthropic, Hugging Face API Keys - Slack Bot Tokens, Webhooks - Stripe, Twilio, SendGrid Keys - Database connection strings (MongoDB, PostgreSQL, MySQL, Redis) - SSH Private Keys, PEM/PFX Certificates - JWT Tokens, Bearer Tokens - Generic passwords in config files (password=, secret=, token=) - Scan individual files, directories, or entire repos recursively - Ignore binary files, node_modules, .git, and other non-relevant paths - Output results as Markdown report or JSON - Provide severity ratings (Critical, High, Medium, Low) - Suggest remediation for each finding ## How to Scan ### Scan a directory ```bash python secret_scanner.py /path/to/project ``` ### Scan with JSON output ```bash python secret_scanner.py /path/to/project --json ``` ### Scan and save report ```bash python secret_scanner.py /path/to/project --output report.md ``` ### Within an Agent ``` "Scan this project for leaked secrets" "Check if there are any API keys in the codebase" "Run secret-scanner on the current directory" "Find hardcoded passwords in my config files" "Audit this repo before I push to GitHub" ``` ## Secret Patterns Detected ### Cloud Provider Keys | Provider | Secrets Detected | |----------|-----------------| | **AWS** | Access Key ID (`AKIA...`), Secret Access Key, Session Token | | **Azure** | Storage Account Key, Connection String, SAS Token, Client Secret | | **GCP** | API Key (`AIza...`), Service Account JSON, OAuth Client Secret | ### AI / LLM Keys | Service | Pattern | |---------|---------| | **OpenAI** | `sk-` prefixed API keys | | **Anthropic** | `sk-ant-` prefixed keys | | **Hugging Face** | `hf_` prefixed tokens | | **Cohere** | API keys in config | ### Developer Platforms | Platform | Secrets Detected | |----------|-----------------| | **GitHub** | `ghp_`, `gho_`, `ghu_`, `ghs_`, `ghr_` tokens | | **GitLab** | `glpat-` tokens | | **Slack** | `xoxb-`, `xoxp-`, `xoxs-` tokens, webhook URLs | | **Stripe** | `sk_live_`, `sk_test_`, `rk_live_` keys | | **Twilio** | Account SID, Auth Token | | **SendGrid** | `SG.` prefixed API keys | ### Databases & Infrastructure | Type | Pattern | |------|---------| | **MongoDB** | `mongodb://` or `mongodb+srv://` with credentials | | **PostgreSQL** | `postgresql://` with embedded password | | **MySQL** | `mysql://` with embedded password | | **Redis** | `redis://` with password | | **SSH** | `-----BEGIN (RSA\|EC\|OPENSSH) PRIVATE KEY-----` | | **Certificates** | PEM, PFX, P12 with embedded keys | ### Generic Patterns | Pattern | Description | |---------|-------------| | **password=** | Hardcoded passwords in config/env files | | **secret=** | Hardcoded secrets | | **token=** | Hardcoded tokens | | **Bearer** | Bearer tokens in code | | **Basic Auth** | Base64-encoded basic auth headers | | **JWT** | `eyJ` prefixed JWT tokens | | **High Entropy** | Long random strings that look like secrets | ## Severity Levels | Severity | Description | Examples | |----------|-------------|----------| | 🔴 **Critical** | Active production credentials | AWS Secret Key, Private Keys, DB passwords | | 🟠 **High** | Service tokens with broad access | GitHub PAT, Slack Bot Token, Stripe Live Key | | 🟡 **Medium** | Keys that may be test/dev | Test API keys, example tokens | | 🟢 **Low** | Potential false positives | Generic password= in comments, placeholder values | ## Files Scanned Scans these file types by default: - Source code: `.py`, `.js`, `.ts`, `.java`, `.go`, `.rb`, `.php`, `.cs`, `.rs` - Config: `.json`, `.yaml`, `.yml`, `.toml`, `.ini`, `.cfg`, `.conf` - Environment: `.env`, `.env.local`, `.env.production` - Shell: `.sh`, `.bash`, `.zsh`, `.ps1` - Docs: `.md`, `.txt` - Other: `Dockerfile`, `docker-compose.yml`, `Makefile` ## Ignored Paths Automatically skips: - `node_modules/`, `vendor/`, `venv/`, `.venv/` - `.git/`, `.svn/` - `__pycache__/`, `.pytest_cache/` - Binary files, images, compiled outputs - `package-lock.json`, `yarn.lock` ## Remediation Guidance When secrets are found, the skill recommends: 1. **Rotate the secret immediately** — assume it's compromised 2. **Remove from code** — use environment variables or a secrets manager instead 3. **Add to .gitignore** — prevent `.env` and credential files from being committed 4. **Use git-filter-repo** — to remove secrets from git history 5. **Enable pre-commit hooks** — to catch secrets before they're committed ## Requirements - Python 3.7+ - No additional dependencies (uses Python standard library) ## Entry Point - **CLI:** `secret_scanner.py` ## Tags #security #secrets #credentials #api-keys #tokens #passwords #scanner #audit #pre-commit #leak-detection #cloud #aws #azure #gcp #devops


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)