scan-secrets
Automates the identification of hardcoded credentials and secrets within repositories using Trivy.
Install
mkdir -p .claude/skills/scan-secrets && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/17972" && unzip -o skill.zip -d .claude/skills/scan-secrets && rm skill.zipInstalls to .claude/skills/scan-secrets
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Scan repositories for secrets and sensitive information using Trivy. Use for: detecting secrets, credentials, API keys, passwords, security audits, vulnerability assessment, SAST scanning.Key capabilities
- →Scan repositories for API keys and tokens.
- →Detect database credentials and private keys.
- →Identify cloud provider credentials and generic passwords.
- →Integrate into CI/CD pipelines for automated checks.
- →Support multiple output formats like JSON, SARIF, and table.
How it works
The skill uses Aqua Security's Trivy scanner to perform complete secret scanning, detecting various types of credentials and sensitive patterns within repositories.
Inputs & outputs
When to use scan-secrets
- →Pre-commit secret scanning
- →Security audit of repo
- →Check PR for secret leaks
- →Compliance scanning
About this skill
Secret Scanning
What This Skill Does
Performs comprehensive secret scanning using Aqua Security's Trivy scanner to detect:
- API keys and tokens
- Database credentials
- Private keys and certificates
- Cloud provider credentials
- Generic passwords and secrets
- Custom secret patterns
When to Use
- Pre-commit checks: Before committing code to prevent secret leaks
- Security audits: Regular repository scanning for compliance
- CI/CD integration: Automated secret detection in pipelines
- Code reviews: Validate pull requests don't contain secrets
- Legacy code analysis: Audit existing codebases for exposed credentials
- DevSecOps: Integrate security scanning into development workflow
Quick Start
- Scan current directory: Run basic scan script
- Scan specific paths: Run targeted scan with custom paths
- CI/CD integration: Use pipeline script for automated checks
- Custom patterns: Configure custom rules for organization-specific secrets
Available Scripts
Basic Scanning
./scripts/scan-basic.sh- Quick scan of current directory./scripts/scan-targeted.sh <path>- Scan specific files/directories./scripts/scan-verbose.sh- Detailed scan with full output
Advanced Features
./scripts/scan-ci.sh- CI/CD optimized with exit codes./scripts/scan-custom.sh- Custom secret patterns./scripts/install-trivy.sh- Install Trivy scanner
Output Formats
./scripts/scan-json.sh- JSON format for automation./scripts/scan-sarif.sh- SARIF format for GitHub Security tab./scripts/scan-table.sh- Human-readable table format
Configuration
The scripts automatically:
- Install Trivy if not present
- Use sensible defaults for secret detection
- Exclude common false positives
- Support multiple output formats
- Integrate with GitHub Security APIs
Integration Examples
Pre-commit Hook
#!/bin/bash
./.github/skills/scan-secrets/scripts/scan-ci.sh
GitHub Action
- name: Scan for secrets
run: ./.github/skills/scan-secrets/scripts/scan-ci.sh
VS Code Task
{
"label": "Scan Secrets",
"type": "shell",
"command": "./.github/skills/scan-secrets/scripts/scan-basic.sh"
}
Troubleshooting
Common Issues:
- Trivy not installed: Run
./scripts/install-trivy.sh - Permission denied: Ensure scripts are executable (
chmod +x scripts/*.sh) - False positives: Edit custom patterns in
scan-custom.sh - Large repositories: Use
scan-targeted.shfor specific paths
Performance Tips:
- Scan specific directories instead of entire repository
- Use
.trivyignorefile to exclude known false positives - Run targeted scans on changed files only in CI
References
When not to use it
- →When the user does not want to scan for secrets or sensitive information.
- →When the user wants to scan for vulnerabilities other than secrets.
- →When the user wants to ignore common false positives without configuration.
Limitations
- →The skill focuses on secret scanning using Trivy.
- →The skill detects specific types of secrets (API keys, credentials, etc.).
- →The skill requires scripts to be executable.
How it compares
This skill provides a specialized and configurable solution for secret scanning using Trivy, offering integration examples for various workflows, unlike general security scans.
Compared to similar skills
scan-secrets side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| scan-secrets (this skill) | 0 | 4mo | Review | Beginner |
| dependency-auditor | 1 | 9mo | Review | Beginner |
| repo-security-posture | 0 | 1mo | Review | Advanced |
| ship-safe | 0 | 1mo | Review | Beginner |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
dependency-auditor
alirezarezvani
Check dependencies for known vulnerabilities using npm audit, pip-audit, etc. Use when package.json or requirements.txt changes, or before deployments. Alerts on vulnerable dependencies. Triggers on dependency file changes, deployment prep, security mentions.
repo-security-posture
superagent-ai
Audit a GitHub repository's security posture and hardening gaps across branch protection, CODEOWNERS, GitHub Actions, publish/release integrity, collaborator access, security features, and dependency review. Use when reviewing or hardening a repo, assessing GitHub configuration, checking CI/CD or Ac
ship-safe
kinncj
Run ship-safe security and quality audit on the current project. Executes npx ship-safe audit . and reports findings by severity. Use before shipping any feature or PR.
ai-security
arcasilesgroup
Runs security gates: SAST with OWASP/CWE mapping, dependency vulnerability scans, secret detection, SBOM generation for compliance, pre-release security verdict. Trigger for 'is this secure', 'audit dependencies', 'check for secrets', 'security report', 'is this package safe', 'compliance review'. N
go-vuln-remediate
infobloxopen
Run Wiz-based vulnerability scan and automatic Go module remediation for containerized Go services in the konk repository. Use when you need to build images, scan CVEs, patch vulnerable dependencies in go.mod/go.sum across konk-service and konk-provision modules, validate builds, and prepare a PR su
security-before-push
antonsmedberg
Use before commit, push, or PR to check secrets, generated junk, unsafe permissions, logging leaks, and durable instruction changes.