Smart Secrets Scanner

Intelligent secrets detection and prevention — scan code, configs, and git history for exposed API keys, passwords, tokens, and credentials

Security Scan

The skill's described purpose (a Node-based secrets scanner) is plausible, but the SKILL.md expects running a local scanner.js with Node and installing hooks while the package provides no code, no install instructions, and no declared Node requirement — that mismatch and the unknown source make this suspicious.

Purpose & Capability

The skill claims to be a Node-based scanner (commands like `node scanner.js scan ...`) but the skill bundle contains no code files, no scanner.js, and no install spec. It also does not declare Node (or any runtime) as a required binary. This is an internal inconsistency: either the skill should include the scanner implementation or declare how to obtain/install it.

Instruction Scope

The runtime instructions stay within the stated scope (scanning files and git history, installing a pre-commit hook, and redacting secrets). However they include actions that modify the repository (hook install, redact) — which is appropriate for a secrets tool but demands caution. The instructions do not describe safeguards, dry-run modes, or where findings are transmitted (no external endpoint declared).

Install Mechanism

There is no install spec — this is instruction-only. That is low-risk by itself, but the instructions assume a local scanner implementation and Node runtime. Without an included binary or a trusted install URL, there's no provenance for the code the instructions ask you to run. The lack of a homepage or source repository increases the risk.

scan_findings_in_context

Intelligent secrets detection — scan code, configs, and git history for exposed API keys, passwords, tokens, and credentials before they leak.

Skill Metadata

• Slug: smart-secrets-scanner
• Version: 1.0.0
• Description: Intelligent secrets and credential scanner for codebases. Detects exposed API keys, passwords, tokens, private keys, and credentials in source code, config files, environment variables, and git commit history. Provides auto-remediation suggestions.
• Category: security
• Trigger Keywords: secrets scanner, credential leak, API key detection, token exposure, security scan, secret detection, git secret

---

Capabilities

1. Scan Current Project

```bash node scanner.js scan ./src node scanner.js scan ./ --include ".js,.json,.yaml,.env*" ``` Detects 50+ patterns: AWS keys, GitHub tokens, Slack webhooks, database URLs, private keys, JWTs, etc.

2. Scan Git History

```bash node scanner.js git-scan --depth 50 node scanner.js git-scan --since "2024-01-01" ``` Finds secrets that were committed and later removed (still in git history).

3. Pre-commit Hook

```bash node scanner.js hook --install

Now every commit is scanned automatically

```

4. Auto-Redact

```bash node scanner.js redact ./src/config.js --replace-with "[REDACTED]" ``` Replace detected secrets with placeholder values.

---

Detection Patterns

Category	Examples
Cloud Keys	AWS_ACCESS_KEY, GCP_SERVICE_ACCOUNT, AZURE_CLIENT_SECRET
API Tokens	GitHub, Slack, Stripe, OpenAI, Anthropic, Google Maps
Database	MongoDB URI, PostgreSQL URL, Redis password
Crypto	RSA private key, SSH key, certificate
App Secrets	JWT secret, session key, encryption key
Config Files	.env, .npmrc, .pypirc, credentials.json

Use Cases

1. CI/CD Pipeline: Block deployments with exposed secrets
2. Pre-commit: Prevent secrets from entering git history
3. Audit: Scan existing codebase for leaked credentials
4. Compliance: SOC2, GDPR requirement for credential management
5. Education: Teach developers about secret management

Output Format

```json { "findings": [ { "file": "src/config.js", "line": 12, "type": "AWS_ACCESS_KEY", "severity": "CRITICAL", "matched": "AKIAIOSFODNN7EXAMPLE", "suggestion": "Move to environment variable or secrets manager" } ], "summary": { "critical": 1, "high": 0, "medium": 2, "low": 5 } } ```