skills.rest
kiurakku
kiurakkuCOMMUNITY
Explore all skills by this author →
𝕏@thefear078GitHub

secrets-audit

Detect exposed secrets and credentials in working trees, git history, and configuration files.

15|3|Updated Jul 9, 2026
Search Tags:#security audit#secrets#api keys#devsecops#git history#credential rotation#gitleaks
One-click install
npx skills add https://github.com/kiurakku/cursor-kit-for-ai --skill secrets-audit-kiurakku
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-audit
Source: https://github.com/kiurakku/cursor-kit-for-ai/tree/main/plugins/security/skills/secrets-audit
Command: npx skills add https://github.com/kiurakku/cursor-kit-for-ai --skill secrets-audit-kiurakku

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Leaked API keys, tokens, and passwords hide in source files, git history, and misconfigured deployments, and deleting a leaked secret without rotating it fixes nothing. This Skill finds exposed credentials before attackers do and drives the full rotation and prevention workflow. ## Core Features & Use Cases - Three-layer scanning: grep-based pattern detection in the working tree (AWS, OpenAI, GitHub, Slack, Google, Telegram key formats), git history scanning for secrets removed in later commits, and a manual configuration review covering .gitignore, Dockerfiles, CI pipelines, logs, and frontend bundles. - Rotation procedure: a strict rotate-first-then-revoke sequence with blast-radius assessment, history scrubbing via git filter-repo, and recurrence prevention through pre-commit hooks and CI scanning. - Severity model and report template: findings classified Critical through Low with a structured Markdown output format that never exposes full secret values. - Use Case: Before open-sourcing a repository, run the audit to discover an AWS key committed six months ago, rotate it at the provider, check access logs for misuse, scrub history, and add a gitleaks pre-commit hook. ## Quick Start Audit this repository for exposed secrets and API keys, including git history, and give me a severity-ranked report with rotation steps.

Frequently Asked Questions about secrets-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find exposed API keys in my git repository?▼

Run grep with high-signal patterns like AKIA[0-9A-Z]{16} for AWS or ghp_ for GitHub tokens across the working tree, excluding .git and node_modules. Tools like gitleaks or trufflehog automate this, but manual config review is still needed since scanners miss context.

How do I scan git history for leaked secrets?▼

Use git log --diff-filter=A to list ever-committed sensitive files like .env or .pem, and git grep across rev-list commits to find key patterns in old revisions. A secret removed in a later commit remains fully visible in history and must be rotated.

What should I do after finding a leaked credential in a repo?▼

Rotate first: issue a new credential, deploy it, then revoke the old one, since revoking first causes an outage. Then assess blast radius via provider audit logs, scrub history with git filter-repo only after rotation, and add pre-commit hooks to prevent recurrence.

Does deleting a secret from the repo fix the leak?▼

No. Deleting the file leaves the secret in git history, caches, and forks, so the credential remains compromised. Rotation at the provider is the only real fix; history scrubbing is cosmetic and optional afterward.

Can Docker builds leak secrets into images?▼

Yes. Secrets passed via ARG, ENV, or COPY .env persist in image layers and are visible through docker history. Use BuildKit secret mounts for build-time needs and keep credentials out of Dockerfiles entirely.

What are the limitations of automated secret scanners like gitleaks?▼

Scanners miss context-dependent issues such as default SECRET_KEY values reaching production, tokens in log statements, or sensitive data in frontend bundles. Combine scanner output with a manual configuration review of .gitignore, CI secret handling, and Terraform state.

Related Skills

Explore More Software Engineering Skills→
emliunixemliunix

privacy-review

Scan Git repositories for exposed secrets and sensitive data.

Community
Advanced
arbazkhan971arbazkhan971
26

secrets

Detect exposed secrets and rotate credentials into secret managers.

Community
Advanced
nhattran998nhattran998

cso

Audits infrastructure and supply chain for secrets, dependency risks, misconfigurations, and vulnerabilities using threat modeling and scanning workflows.

Community
Advanced
4lerman4lerman

secrets-vault-manager

Manages secret lifecycle, rotation, policies, and audit across Vault and cloud secret stores.

Community
Advanced