Which scanners does the Secrets skill use?

The skill prioritizes Gitleaks and TruffleHog if they are installed on your system. If no external scanners are found, it falls back to Claude's internal pattern-based analysis.

How does it handle false positives like 'YOUR_API_KEY_HERE'?

The skill includes contextual analysis to identify and exclude common placeholders, dummy values, and documentation examples, focusing only on high-confidence, potentially exploitable secrets.

Can it detect secrets that were deleted in old commits?

Yes, by using the --depth deep or --depth expert flags, the skill scans your entire git history to find secrets that were previously committed and subsequently 'removed' from the current code state.

Does this skill display the full secret in the audit report?

No, for security reasons, the skill automatically masks the middle portion of any detected secrets (e.g., AKIA****XMPL) to prevent further exposure in your logs or terminal.

Secrets Detection & Security Scanning

Name: Secrets Detection & Security Scanning
Author: florianbuetow

byflorianbuetow

•

Security & Testing

Identifies and remediates hardcoded credentials, API keys, and sensitive tokens across source code and git history.

The Secrets Detection skill provides a robust security layer for your development workflow by scanning projects for exposed sensitive information such as AWS keys, database passwords, and private keys. By combining industry-standard scanners like Gitleaks and TruffleHog with Claude’s contextual intelligence, it detects immediate vulnerabilities in your current files and deep within your git history, providing actionable remediation steps to rotate credentials and secure your repository.

Key Features

01Deep git history scanning to find leaked credentials in past commits

02Standardized security reporting with CWE mapping and severity scoring

03Automated remediation including .gitignore updates and secret removal

046 GitHub stars

05Integration with Gitleaks, TruffleHog, and Trivy for comprehensive coverage

06Heuristic pattern matching for high-entropy strings and custom API keys

Use Cases

01Automating credential checks during code reviews to maintain repository hygiene

02Performing a pre-release security audit to ensure no credentials are leaked to production

03Cleaning up legacy git history where sensitive tokens were accidentally committed

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add florianbuetow/claude-code secrets

For use in Claude.ai and ChatGPT

Download Skill