Does it support entropy analysis?

Yes, it uses entropy analysis to identify potential secrets that don't follow standard patterns, such as custom tokens or high-randomness strings that might be credentials.

How do I trigger a secret scan with Claude?

You can initiate a scan by asking Claude to 'scan for secrets', 'find exposed keys', or 'check for credentials' within your project directory.

What types of secrets can this skill detect?

It detects a wide range of sensitive data including AWS/GCP/Azure keys, SSH private keys, PGP keys, database passwords, and generic API tokens via regex and entropy analysis.

Can it help me fix the security issues it finds?

Absolutely. The skill generates a detailed report that includes specific remediation steps and code examples to help you move secrets into environment variables or secure vaults.

Is this skill suitable for pre-commit checks?

Yes, you can use Claude to run this skill as part of your development workflow to proactively find secrets before committing changes to your version control system.

Secret Scanner

Name: Secret Scanner
Author: BbgnsurfTech

byBbgnsurfTech

•

Security & Testing

Identifies and remediates exposed secrets, API keys, and sensitive credentials within your codebase to prevent security breaches.

The Secret Scanner skill enhances Claude Code by providing automated detection of hardcoded credentials, private keys, and API tokens using advanced pattern matching and entropy analysis. It helps developers audit their repositories for accidental leaks, ensuring that sensitive information like AWS keys, database passwords, and SSH keys are identified before they are committed or deployed. By integrating seamlessly with Claude's file-handling capabilities, it offers a proactive layer of security that streamlines vulnerability management and ensures compliance with modern security standards.

Key Features

01Pattern-based detection for major cloud providers like AWS, GCP, and Azure

02Entropy analysis to identify unstructured secrets and high-randomness strings

03Actionable remediation recommendations including code examples for secure storage

043 GitHub stars

05Automated scanning of configuration files, environment templates, and scripts

06Comprehensive reporting with precise file locations and severity levels

Use Cases

01Scanning configuration files like .env or database.yml for hardcoded passwords

02Reviewing code changes to identify accidentally staged private keys or tokens

03Auditing a repository before making it public to ensure no API keys are exposed

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add bbgnsurftech/claude-skills-collection secret-scanner

For use in Claude.ai and ChatGPT

Download Skill