Scanning For Hardcoded Secrets

What it does

When your agent uses it

• : pre-commit gate before pushing a feature branch
• Audit before SOC2
• Post-incident scan after a leak
• Inheriting a codebase you didnt write

Example prompts

• “scan secrets”
• “credential scan”
• “find hardcoded keys”
• “/scanning-for-hardcoded-secrets”

Requirements

• Python 3
• A credential in JWT_SECRET
• Compatibility (from SKILL.md): Designed for Claude Code
• Pre-approved tools (allowed-tools): Read, Bash(python3:*), Glob, Grep

Workflow steps

4 steps, taken from the step headings in SKILL.md.

1. 1Identify the scan target
2. 2Run the scanner
3. 3Interpret findings
4. 4Remediation

What it can do on your machine

Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Bash(python3:*)
  • Glob
  • Grep

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Ships 1 file in scripts/ (Python), which the agent can run.

  Shell commands in SKILL.md call:

  • python3
  • git
  • jq

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use git, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • JWT_SECRET

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

• Compatibility

  Designed for Claude Code

  From compatibility in the SKILL.md frontmatter.

Context cost

Scanning For Hardcoded Secrets loads about 2.1k tokens when it runs, and up to ~5.9k if it reads all its reference files. Until then it costs about 203 tokens; SKILL.md has 707 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~203

When it runs · the whole SKILL.md, loaded when a task matches

~2.1k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~5.9k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:27

  - Write(.env)

• NoteMentions a .env fileSKILL.md:28

  - Edit(.env)

• NoteMentions a .env fileSKILL.md:83

  | `.env`-shaped KEY=VALUE in non-`.env` file | **HIGH** | Multiple `[A-Z_]+=` lines in `.py`/`.js`/`.md` files | CWE-200

• NoteMentions a .env fileSKILL.md:213

  (Python dotenv, Node .env+dotenv, Ruby Rails credentials, Go

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.

SKILL.md

The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 707 words, ~2,115 tokens.

name

scanning-for-hardcoded-secrets

description

Scan a source-code tree for hardcoded credentials embedded in source files: AWS access keys, GitHub tokens, Stripe keys, Slack tokens, Anthropic API keys, OpenAI keys, JWT signing secrets, generic base64-encoded passwords, RSA / SSH private keys, and high-entropy string literals that pattern-match common credential shapes. Use when: pre-commit gate before pushing a feature branch, audit before SOC2, post-incident scan after a leak, or inheriting a codebase you didn't write. Threshold: any source file contains a string that matches a canonical credential regex (AWS AKIA prefix, GitHub ghp_ prefix, etc.) OR a string with Shannon entropy above 4.5 in a field context (key=, token:, secret=). Trigger with: "scan secrets", "credential scan", "find hardcoded keys", "leak check".

allowed-tools

Read, Bash(python3:*), Glob, Grep

compatibility

Designed for Claude Code

disallowed-tools

Bash(rm:*), Bash(curl:*), Bash(wget:*), Write(.env), Edit(.env)

version

3.30.0

author

Jeremy Longshore <jeremy@intentsolutions.io>

license

MIT

tags

security, static-analysis, secrets, pentest

python3 ${CLAUDE_PLUGIN_ROOT}/skills/scanning-for-hardcoded-secrets/scripts/scan_secrets.py /path/to/repo

Usage: scan_secrets.py PATH [OPTIONS]

Options:
  --output FILE      Write findings to FILE (default: stdout)
  --format FMT       json | jsonl | markdown (default: markdown)
  --min-severity SEV (default: info)
  --include-tests    Include files under tests/, test/, __tests__/, spec/
                     (default: excluded to reduce false positives)
  --git-history N    Also scan the last N git commits' diffs (default: 0
                     = working tree only)
  --exclude GLOB     Skip files matching glob (repeatable)
  --entropy-only     Only flag entropy-based findings (skip regex)

# .git/hooks/pre-commit (or via pre-commit framework)
python3 plugins/security/penetration-tester/skills/scanning-for-hardcoded-secrets/scripts/scan_secrets.py \
    --min-severity high --format json . | jq -e 'length == 0' \
    || { echo "Secrets detected. Fix before commit."; exit 1; }

- name: Hardcoded-secrets scan
  run: |
    python3 plugins/security/penetration-tester/skills/scanning-for-hardcoded-secrets/scripts/scan_secrets.py \
        . --min-severity high --format json --output secrets-scan.json
- run: |
    if jq 'length > 0' secrets-scan.json | grep -q true; then
      echo "::error::Hardcoded secret detected"
      exit 1
    fi

python3 ${CLAUDE_PLUGIN_ROOT}/skills/scanning-for-hardcoded-secrets/scripts/scan_secrets.py \
    /path/to/acquired-repo --include-tests --min-severity medium

© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

SKILL.md and 3 other files (scripts, references) in skills/.curated/scanning-for-hardcoded-secrets of jeremylongshore/tons-of-skills-marketplace.

• SKILL.md
• references/PLAYBOOK.md
• references/THEORY.md
• scripts/scan_secrets.py

Open the folder on GitHubat commit cfae287