SageMaker IAM Role Preflight
huggingface/skills
Finds or validates a usable SageMaker execution role before deploying or training, so scripts do not try to create IAM roles they lack permission to create.
Detect exposed secrets, API keys, and credentials in code. An agent skill from jeremylongshore/tons-of-skills-marketplace.
MITAuto-check: notes
Install Scanning For Secrets
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace scanning-for-secrets --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .claude/skills && cp -r skills-src/skills/.curated/scanning-for-secrets .claude/skills/scanning-for-secrets && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "scanning-for-secrets" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secrets into .claude/skills/scanning-for-secrets/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scanning-for-secrets", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secretsType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace scanning-for-secrets --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .agents/skills && cp -r skills-src/skills/.curated/scanning-for-secrets .agents/skills/scanning-for-secrets && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "scanning-for-secrets" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secrets into .agents/skills/scanning-for-secrets/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scanning-for-secrets", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace scanning-for-secrets --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/skills/.curated/scanning-for-secrets .cursor/skills/scanning-for-secrets && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "scanning-for-secrets" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secrets into .cursor/skills/scanning-for-secrets/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scanning-for-secrets", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/jeremylongshore/tons-of-skills-marketplace.git --path skills/.curated/scanning-for-secrets--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace scanning-for-secrets --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/skills/.curated/scanning-for-secrets .gemini/skills/scanning-for-secrets && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "scanning-for-secrets" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secrets into .gemini/skills/scanning-for-secrets/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scanning-for-secrets", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install jeremylongshore/tons-of-skills-marketplace scanning-for-secretsInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .github/skills && cp -r skills-src/skills/.curated/scanning-for-secrets .github/skills/scanning-for-secrets && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "scanning-for-secrets" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secrets into .github/skills/scanning-for-secrets/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scanning-for-secrets", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install jeremylongshore/tons-of-skills-marketplace scanning-for-secrets --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/jeremylongshore/tons-of-skills-marketplace.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/skills/.curated/scanning-for-secrets .opencode/skills/scanning-for-secrets && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "scanning-for-secrets" agent skill from https://github.com/jeremylongshore/tons-of-skills-marketplace/tree/main/skills/.curated/scanning-for-secrets into .opencode/skills/scanning-for-secrets/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "scanning-for-secrets", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
scanning-for-secrets- GitHub stars
- 2.8k
- Token cost
- ~1k tokens
- SKILL.md length
- 477 words
- Files
- 4 (incl. scripts, references, assets)
- Skills in repo
- 3,342
- Repo updated
- First seen
- Licence
- MIT
At a glance
Detect exposed secrets, API keys, and credentials in code. An agent skill from jeremylongshore/tons-of-skills-marketplace.
- Works in 3 steps: Initiate Scan: Claude activates the… → Codebase Analysis: The plugin scans the… → Report Generation: A detailed report is…
- Auditing for secret leaks
- SKILL.md covers Overview, How It Works, When to Use This Skill and Examples, plus 7 more sections
- With scan for secrets
What it does
Scanning For Secrets is an agent skill from jeremylongshore/tons-of-skills-marketplace. Detect exposed secrets, API keys, and credentials in code. Use when auditing for secret leaks. Trigger with 'scan for secrets', 'find exposed keys', or 'check credentials'.
Its SKILL.md is about 1k tokens, which your agent loads only when the skill is triggered. The skill folder holds 6 other files, including scripts, reference files and assets (for example `assets/README.md`, `references/README.md` and `scripts/README.md`). Compatibility notes: Designed for Claude Code
It works with Amazon Web Services. The repository describes itself as: Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com. The licence is MIT.
When your agent uses it
- Auditing for secret leaks
- With scan for secrets
- Find exposed keys
- Check credentials
Example prompts
- “scan for secrets”
- “find exposed keys”
- “check credentials”
- “/scanning-for-secrets”
Requirements
- Compatibility (from SKILL.md): Designed for Claude Code
- Pre-approved tools (allowed-tools): Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- Initiate Scan: Claude activates the secret-scanner plugin.
- Codebase Analysis: The plugin scans the codebase using pattern matching and entropy analysis.
- Report Generation: A detailed report is generated, highlighting identified secrets, their locations, and suggested remediation steps.
What it can do on your machine
Read from SKILL.md and the folder at commit cfae287. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves these tools, so the agent can use them without asking each time:
ReadWriteEditGrepGlobBash(security:*)Bash(scan:*)Bash(audit:*)
From allowed-tools in the SKILL.md frontmatter.
Runs code
Ships 1 file in scripts/, which the agent can run.
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names no API keys, tokens, secrets or passwords.
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Compatibility
Designed for Claude Code
From compatibility in the SKILL.md frontmatter.
Context cost
Scanning For Secrets loads about 1k tokens when it runs, and up to ~1k if it reads all its reference files. Until then it costs about 48 tokens; SKILL.md has 477 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check: notes
The automated check noted patterns worth knowing about, such as sudo or a known installer.
- NoteMentions a .env fileSKILL.md:58
figuration files (e.g., `database.yml`, `.env`) for password patterns.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); the scripts in this folder are not scanned.
SKILL.md
The full file from jeremylongshore/tons-of-skills-marketplace at commit cfae287, republished under its MIT licence (© jeremylongshore). 477 words, ~1,032 tokens.
Download SKILL.mdSave it as
.claude/skills/scanning-for-secrets/SKILL.md (or your agent's skills folder). This skill also uses 3 other files; get the full folder from GitHub.- name
- scanning-for-secrets
- description
- Detect exposed secrets, API keys, and credentials in code. Use when auditing for secret leaks. Trigger with 'scan for secrets', 'find exposed keys', or 'check credentials'.
- allowed-tools
- Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*)
- compatibility
- Designed for Claude Code
- version
- 1.24.0
- license
- MIT
- author
- Jeremy Longshore <jeremy@intentsolutions.io>
- tags
- security, api, audit
Secret Scanner
Detect exposed API keys, passwords, tokens, and private keys in source code using pattern matching and entropy analysis, with remediation guidance for each finding.
Overview
scan your codebase for exposed secrets, API keys, passwords, and other sensitive credentials. It helps you identify and remediate potential security vulnerabilities before they are committed or deployed.
How It Works
- Initiate Scan: Claude activates the
secret-scannerplugin. - Codebase Analysis: The plugin scans the codebase using pattern matching and entropy analysis.
- Report Generation: A detailed report is generated, highlighting identified secrets, their locations, and suggested remediation steps.
When to Use This Skill
This skill activates when you need to:
- Scan your codebase for exposed API keys (e.g., AWS, Google, Azure).
- Check for hardcoded passwords in configuration files.
- Identify potential private keys (SSH, PGP) accidentally committed to the repository.
- Proactively find secrets before committing changes.
Examples
Example 1: Identifying Exposed AWS Keys
User request: "Scan for AWS keys in the codebase"
The skill will:
- Activate the
secret-scannerplugin. - Scan the codebase for patterns matching AWS Access Keys (AKIA[0-9A-Z]{16}).
- Generate a report listing any found keys, their file locations, and remediation steps (e.g., revoking the key).
Example 2: Checking for Hardcoded Passwords
User request: "Check for exposed credentials in config files"
The skill will:
- Activate the
secret-scannerplugin. - Scan configuration files (e.g.,
database.yml,.env) for password patterns. - Generate a report detailing any found passwords and suggesting the use of environment variables.
Best Practices
- Regular Scanning: Schedule regular scans to catch newly introduced secrets.
- Pre-Commit Hooks: Integrate the
secret-scannerinto your pre-commit hooks to prevent committing secrets. - Review Entropy Analysis: Carefully review results from entropy analysis, as they may indicate potential secrets not caught by pattern matching.
Show full SKILL.md (187 more words)Show less
Integration
This skill can be integrated with other security tools, such as vulnerability scanners, to provide a comprehensive security assessment of your codebase. It can also be combined with notification plugins to alert you when new secrets are detected.
Prerequisites
- Access to codebase and configuration files in ${CLAUDE_SKILL_DIR}/
- Security scanning tools installed as needed
- Understanding of security standards and best practices
- Permissions for security analysis operations
Instructions
- Identify security scan scope and targets
- Configure scanning parameters and thresholds
- Execute security analysis systematically
- Analyze findings for vulnerabilities and compliance gaps
- Prioritize issues by severity and impact
- Generate detailed security report with remediation steps
Output
- Security scan results with vulnerability details
- Compliance status reports by standard
- Prioritized list of security issues by severity
- Remediation recommendations with code examples
- Executive summary for stakeholders
Error Handling
If security scanning fails:
- Verify tool installation and configuration
- Check file and directory permissions
- Validate scan target paths
- Review tool-specific error messages
- Ensure network access for dependency checks
Resources
- Security standard documentation (OWASP, CWE, CVE)
- Compliance framework guidelines (GDPR, HIPAA, PCI-DSS)
- Security scanning tool documentation
- Vulnerability remediation best practices
© jeremylongshore, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file
Files
SKILL.md and 3 other files (scripts, references, assets) in skills/.curated/scanning-for-secrets of jeremylongshore/tons-of-skills-marketplace.
- SKILL.md
- assets/README.md
- references/README.md
- scripts/README.md
Open the folder on GitHubat commit cfae287
Compare with similar skills
Scanning For Secrets next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Scanning For Secrets this skilljeremylongshore/tons-of-skills-marketplace | 2.8k | — | ~1k | Automated safety check: Notes | MIT | |
| SageMaker IAM Role Preflighthuggingface/skills | 11k | 1 repos | ~1.8k | Automated safety check: Pass | Apache-2.0 | |
| SageMaker Serving Image Selectionhuggingface/skills | 11k | 1 repos | ~4.6k | Automated safety check: Pass | Apache-2.0 | |
| Cloud Cost Optimizationwshobson/agents | 40k | 14 repos | ~1.7k | Automated safety check: Pass | MIT | |
| Python Environment Setup for SageMakerhuggingface/skills | 11k | 2 repos | ~1.7k | Automated safety check: Pass | Apache-2.0 | |
| Agent Squad Python Guide2FastLabs/agent-squad | 7.8k | — | ~4.7k | Automated safety check: Pass | Apache-2.0 |
Similar skills
- Official
- Official
SageMaker Serving Image Selection
huggingface/skills
Chooses the right serving container and current image URI for deploying a Hugging Face model to a SageMaker endpoint, preferring Hugging Face images over generic ones.
Cloud Cost Optimization
wshobson/agents
Cuts cloud spend across AWS, Azure, GCP and OCI with cost tagging, rightsizing, commitment and spot pricing models, and architecture changes.
- Official
Python Environment Setup for SageMaker
huggingface/skills
Sets up an isolated Python environment with a supported interpreter and current boto3 before any SageMaker deployment, training or AWS automation code runs.
Agent Squad Python Guide
2FastLabs/agent-squad
Map of the agent-squad Python framework for async multi-agent orchestration: which agent, classifier, storage and tool provider to pick, and the pitfalls to avoid.
Paperclip Page
paperclipai/paperclip
Publish static HTML pages and asset folders to the Paperclip S3/CloudFront page host.
More from jeremylongshore/tons-of-skills-marketplace
All 3,342 skills in this repoPerforming Security Code Review
jeremylongshore/tons-of-skills-marketplace
Execute this skill enables AI assistant to conduct a security-focused code review using the security-agent plugin.
Adapting Transfer Learning Models
jeremylongshore/tons-of-skills-marketplace
Build this skill automates the adaptation of pre-trained machine learning models using transfer learning techniques.
Agent Context Loader
jeremylongshore/tons-of-skills-marketplace
Execute proactive auto-loading: automatically detects and loads agents.md files.
Aggregating Performance Metrics
jeremylongshore/tons-of-skills-marketplace
Aggregate and centralize performance metrics from applications, systems, databases, caches, and services.
Analyzing Capacity Planning
jeremylongshore/tons-of-skills-marketplace
Execute this skill enables AI assistant to analyze capacity requirements and plan for future growth.
Analyzing Database Indexes
jeremylongshore/tons-of-skills-marketplace
Process use when you need to work with database indexing. An agent skill from jeremylongshore/tons-of-skills-marketplace.
Related
Works with
Questions about Scanning For Secrets
What does Scanning For Secrets do?
Detect exposed secrets, API keys, and credentials in code. An agent skill from jeremylongshore/tons-of-skills-marketplace. Scanning For Secrets is an agent skill from jeremylongshore/tons-of-skills-marketplace. Detect exposed secrets, API keys, and credentials in code.
When should I use Scanning For Secrets?
Scanning For Secrets fits situations like: auditing for secret leaks; with scan for secrets; find exposed keys; check credentials.
How do I install Scanning For Secrets in Claude Code?
Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a claude-code`. Or copy the skill folder (skills/.curated/scanning-for-secrets in jeremylongshore/tons-of-skills-marketplace) into .claude/skills/scanning-for-secrets in your project. Claude Code loads it when a task matches its description.
How do I install Scanning For Secrets in Codex?
Run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a codex`. Or copy the skill folder (skills/.curated/scanning-for-secrets in jeremylongshore/tons-of-skills-marketplace) into .agents/skills/scanning-for-secrets in your project. Codex loads it when a task matches its description.
Can I use Scanning For Secrets in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add jeremylongshore/tons-of-skills-marketplace --skill scanning-for-secrets -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/scanning-for-secrets, .gemini/skills/scanning-for-secrets, .github/skills/scanning-for-secrets and .opencode/skills/scanning-for-secrets in your project.
What does Scanning For Secrets need to run?
SKILL.md names no scripts, command-line tools or credentials: Scanning For Secrets is instructions for the agent only. Its frontmatter pre-approves these tools: Read, Write, Edit, Grep, Glob, Bash(security:*), Bash(scan:*), Bash(audit:*). Compatibility (from SKILL.md): Designed for Claude Code.
Does Scanning For Secrets access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Scanning For Secrets safe to install?
Our automated static check of SKILL.md found notes only (mentions a .env file), nothing it rates as a warning. It is not a guarantee. The check reads SKILL.md only: the scripts in the folder are not scanned, so read them before running anything.
What licence does Scanning For Secrets use?
Scanning For Secrets is published under the MIT licence (declared in SKILL.md). It allows redistribution, so the full SKILL.md is shown on this page.
How many tokens does Scanning For Secrets use?
About 1k tokens (SKILL.md is roughly 4.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full. Its references folder adds about 15 tokens, read only when the agent opens those files.
What are the alternatives to Scanning For Secrets?
Skills that share tags, products or a category with Scanning For Secrets: SageMaker IAM Role Preflight (huggingface/skills, 11k stars), SageMaker Serving Image Selection (huggingface/skills, 11k stars), Cloud Cost Optimization (wshobson/agents, 40k stars) and Python Environment Setup for SageMaker (huggingface/skills, 11k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Scanning For Secrets?
jeremylongshore (a GitHub user) maintains it in jeremylongshore/tons-of-skills-marketplace, which has 2,827 GitHub stars. The repository holds 3,342 skills in this directory. The repository was last updated on October 10, 2026.
Source: jeremylongshore/tons-of-skills-marketplace on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.