skills.rest
shawn-sandy
shawn-sandyCOMMUNITY
Explore all skills by this author →
Website𝕏@shawnsandyGitHub

security-scrub

Scans code and diffs for secrets, credentials, and PII before sharing.

Updated Jun 8, 2026
Search Tags:#code review#security#credentials#git diff#leak prevention#secret scanning#pii detection
One-click install
npx skills add https://github.com/shawn-sandy/agentics-kit --skill security-scrub-shawn-sandy
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-scrub
Source: https://github.com/shawn-sandy/agentics-kit/tree/main/kit/plugins/social-media-tools/skills/security-scrub
Command: npx skills add https://github.com/shawn-sandy/agentics-kit --skill security-scrub-shawn-sandy

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve? Sharing code snippets, diffs, or logs can accidentally leak API keys, tokens, private keys, and personal data. This Skill scans content before it is shared and produces a structured verdict so leaks are caught before they happen. ## Core Features & Use Cases - Pattern-Based Secret Detection: Matches HIGH, MEDIUM, and LOW severity patterns covering OpenAI/Anthropic keys, GitHub and GitLab tokens, AWS keys, Slack webhooks, JWTs, private keys, and database connection strings. - Structured Verdicts: Emits a machine-readable SCRUB RESULT block (PASS, WARN, or BLOCKED) plus a GATE RESULT line that callers can check programmatically. - File-Path Block List: Blocks content originating from sensitive paths like .env, ~/.ssh/, and credentials files regardless of content. - Use Case: Before pasting a git diff into a chat or pull request, run the scan to confirm no tokens or internal hostnames are exposed, with all matched values masked in the report. ## Quick Start Ask the assistant to scan this diff for secrets and sensitive data before I share it.

Frequently Asked Questions about security-scrub

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I check code for secrets before sharing it?▼

Provide the content as inline text or a file path and the scan runs regex patterns for API keys, tokens, private keys, and credentials. It returns a SCRUB RESULT verdict of PASS, WARN, or BLOCKED with all matched values masked.

What types of secrets does a secret scanner detect?▼

This scan detects OpenAI and Anthropic API keys, GitHub and GitLab tokens, AWS access keys, Slack tokens and webhooks, Stripe live keys, Google API keys, JWTs, private key blocks, and database connection strings with embedded credentials.

Can I scan a git diff for leaked credentials?▼

Yes, diffs are a primary input. The scan checks the diff content against the pattern table and also verifies referenced file paths against a block list covering .env files, SSH keys, and cloud credential files.

What happens when the scan finds a HIGH severity secret?▼

Any HIGH finding results in SCRUB RESULT: BLOCKED, which is a hard stop with no user override prompt. The matched value is masked to its first and last four characters, and the caller must not proceed with sharing.

Does the scanner ever show the full secret value?▼

No, all matched values are masked using the first four characters plus the last four characters, such as sk-a***wxyz. Unmasked secret values are never included in the report output.

Related Skills

Explore More Software Engineering Skills→
jaqgjaqg

qr-code

Generate PNG or SVG QR codes from URLs or text with LaTeX snippets.

Community
Intermediate
mei28mei28
3

antigravity-review

Compare working-tree diffs against Antigravity CLI reviews for verdicts.

Community
Intermediate
RedBeretRedBeret

publish-quality

Execute pre-publish security and compliance checks on code repositories.

Community
Advanced
marquesfelipmarquesfelip

secrets-exposure-detection

Detect exposed credentials and secrets across codebases, logs, and environments.

Community
Advanced