Secret Scanner

What it does

When your agent uses it

• Security checks
• .env file modifications

Example prompts

• “/secret-scanner”

Requirements

• Python 3
• Docker
• A credential in STRIPE_API_KEY
• A credential in API_KEY
• Pre-approved tools (allowed-tools): Read, Grep

Workflow steps

5 steps, taken from the first numbered list in SKILL.md.

1. 1Never commit secrets - Use environment variables
2. 2Use .gitignore - Add .env, secrets.json, etc.
3. 3Rotate exposed secrets - If committed, rotate immediately
4. 4Use secret management - AWS Secrets Manager, HashiCorp Vault
5. 5Audit regularly - Review code for exposed secrets

What it can do on your machine

Read from SKILL.md and the folder at commit 4b68050. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Grep

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • git

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • API_KEY
  • DB_PASSWORD
  • STRIPE_API_KEY
  • AWS_ACCESS_KEY_ID

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Secret Scanner loads about 1.4k tokens when it runs. Until then it costs about 66 tokens; SKILL.md has 305 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~66

When it runs · the whole SKILL.md, loaded when a task matches

~1.4k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:3

  e changes, git commits, security checks, .env file modifications.

• NoteMentions a .env fileSKILL.md:16

  - ✅ .env files changed

• NoteMentions a .env fileSKILL.md:59

  📖 Add to .gitignore: .env

• NoteMentions a .env fileSKILL.md:84

  🔧 Fix: Use .env file

• NoteMentions a .env fileSKILL.md:86

  📖 Add .env to .gitignore

• NoteMentions a .env fileSKILL.md:121

  - .env:5 - Database password (in gitignore - OK)

• NoteMentions a .env fileSKILL.md:132

  ✅ .env - In .gitignore (good)

• WarningMentions a credentials file (SSH keys, cloud or package-manager tokens)SKILL.md:134

  ✅ .aws/credentials - In .gitignore (good)

• NoteMentions a .env fileSKILL.md:181

  // .env file (add to .gitignore):

• NoteMentions a .env fileSKILL.md:201

  - API_KEY=${API_KEY}  # From .env file

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from alirezarezvani/claude-code-tresor at commit 4b68050, republished under its MIT licence (© alirezarezvani). 305 words, ~1,445 tokens.

name

secret-scanner

description

Detect exposed secrets, API keys, credentials, and tokens in code. Use before commits, on file saves, or when security is mentioned. Prevents accidental secret exposure. Triggers on file changes, git commits, security checks, .env file modifications.

allowed-tools

Read, Grep

// You type:
const apiKey = 'sk_live_1234567890abcdef';

// I immediately alert:
🚨 CRITICAL: Exposed Stripe API key detected!
📍 File: config.js, Line 3
🔧 Fix: Use environment variables
  const apiKey = process.env.STRIPE_API_KEY;
📖 Add to .gitignore: .env

# You type:
aws_access_key = "AKIAIOSFODNN7EXAMPLE"

# I alert:
🚨 CRITICAL: AWS access key exposed!
📍 File: aws_config.py, Line 1
🔧 Fix: Use AWS credentials file or environment variables
  aws_access_key = os.getenv("AWS_ACCESS_KEY_ID")
📖 Never commit AWS credentials

# You type in docker-compose.yml:
environment:
  DB_PASSWORD: "mySecretPassword123"

# I alert:
🚨 CRITICAL: Database password in configuration file!
📍 File: docker-compose.yml, Line 5
🔧 Fix: Use .env file
  DB_PASSWORD: ${DB_PASSWORD}
📖 Add .env to .gitignore

# Before commit, I scan:
git add .
git commit

# I block if secrets found:
🚨 CRITICAL: Cannot commit - secrets detected!
📍 3 secrets found:
  - config.js:12 - API key
  - .env:5 - Database password (in gitignore - OK)
  - auth.js:45 - JWT secret

❌ Commit blocked - remove secrets first

✅ .env - In .gitignore (good)
⚠️ config/secrets.json - NOT in .gitignore (add it!)
✅ .aws/credentials - In .gitignore (good)

// I understand these are examples:
// Example: const apiKey = 'your_api_key_here';
// TODO: Add your API key from environment

// Test fixtures are OK (but flagged for review):
const mockApiKey = 'sk_test_1234567890abcdef';  // ✅ Test key

<!-- Documentation examples are flagged but low priority -->
Set your API key: `export API_KEY=your_key_here`

secret-scanner: Finds hardcoded API key
security-auditor: Finds how the key is used insecurely
Combined: Complete security picture

// Before:
const apiKey = 'sk_live_abc123';

// After:
const apiKey = process.env.API_KEY;

// .env file (add to .gitignore):
API_KEY=sk_live_abc123

// AWS Secrets Manager
const AWS = require('aws-sdk');
const secrets = new AWS.SecretsManager();
const secret = await secrets.getSecretValue({ SecretId: 'myApiKey' }).promise();

# docker-compose.yml
services:
  app:
    environment:
      - API_KEY=${API_KEY}  # From .env file

# .env (gitignored)
API_KEY=sk_live_abc123

cp -r ~/.claude/skills/security/secret-scanner \
      ~/.claude/skills/security/company-secret-scanner

# Edit SKILL.md to add:
# - Internal API key formats
# - Company-specific secret patterns
# - Custom detection rules

© alirezarezvani, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 1 other file in skills/security/secret-scanner of alirezarezvani/claude-code-tresor.

• SKILL.md
• README.md

Open the folder on GitHubat commit 4b68050