skills.rest
real-case
real-caseCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

sec-secrets

Detect leaked secrets, credentials, and private keys across source code and git history.

Updated Apr 16, 2026
Search Tags:#security audit#api keys#git history#gitleaks#trufflehog#secret scanning#credential detection
One-click install
npx skills add https://github.com/real-case/marvin-toolkit --skill sec-secrets-real-case
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: sec-secrets
Source: https://github.com/real-case/marvin-toolkit/tree/main/plugins/marvin/skills/sec-secrets
Command: npx skills add https://github.com/real-case/marvin-toolkit --skill sec-secrets-real-case

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Hardcoded API keys, passwords, and tokens often slip into source code and remain buried in git history even after deletion, creating serious security exposure before deployments, open-sourcing, or incident response. ## Core Features & Use Cases - Pattern-based code scanning: Searches for cloud provider keys (AWS, GCP, Azure), SaaS tokens (GitHub, Stripe, Slack, OpenAI), private keys, and database connection strings using high-signal regex patterns with false-positive filtering. - Git history analysis: Finds secrets that were committed and later removed, with optional trufflehog and gitleaks integration for deeper verified scanning. - Configuration audit: Checks .gitignore coverage, .env file parity, and secret manager adoption, then produces a deduplicated report with severity ratings and rotation guidance. - Use Case: Before open-sourcing a repository, run a full scan to discover an old AWS access key still present in git history, then follow the provided rotation and history-cleanup steps. ## Quick Start Ask the assistant to scan this repository for leaked secrets and credentials, including the git history, and write the findings report.

Frequently Asked Questions about sec-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a repository for leaked secrets and API keys?▼

Run a pattern-based scan that greps the codebase for known credential formats like AWS AKIA keys, GitHub tokens, Stripe live keys, and private key headers. Combine this with git history scanning to catch secrets that were committed and later deleted.

Can a scan find secrets that were deleted from the code?▼

Yes. Secrets removed from current code still exist in git history and are accessible to anyone who clones the repository. The scan uses git log with pickaxe searches and optionally trufflehog or gitleaks to surface them, and they must be rotated regardless.

What is the difference between gitleaks and trufflehog for secret detection?▼

Both scan git history for leaked credentials, but trufflehog can verify whether found secrets are still active using its --only-verified mode, while gitleaks focuses on fast pattern-based detection. The scan uses whichever is installed and recommends installing one if neither is present.

Why does secret scanning report false positives?▼

Test fixtures, example configs, and placeholder values like 'changeme' naturally match credential patterns. The scan marks these as false positives in the report rather than hiding them, so reviewers can confirm each match was evaluated.

What should I do first when a leaked key is found in git history?▼

Rotate the credential immediately at the provider, such as deactivating an AWS access key in IAM or revoking a GitHub token. History cleanup with git filter-repo or BFG comes second, since rewriting history does not invalidate an already-exposed key.

Related Skills

Explore More Software Engineering Skills→
woohyun212woohyun212
21

secret-scan

Scan source code and Git history for secrets using trufflehog or gitleaks.

Community
Advanced
bianhaifeng789-huebianhaifeng789-hue

sanitize-git-repo

Detect and remove committed secrets from git repositories and history.

Community
Advanced
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced
patricio0312revpatricio0312rev
5

secrets-scanner

Detect leaked credentials in codebases across pre-commit hooks and CI pipelines.

Community
Advanced