What problem does it solve? Hardcoded API keys, passwords, and tokens committed to repositories create serious security exposure. This Skill scans code and configuration for credential patterns, entropy anomalies, and secrets buried in git history before they become breaches. ## Core Features & Use Cases - Pattern-Based Detection: Matches known key formats such as AWS AKIA keys, GitHub ghp_ tokens, Slack xoxb/xoxp tokens, and JWT signatures, plus suspicious variable names like password, apiKey, and connection_string. - Entropy and Hiding-Spot Analysis: Flags high-entropy strings in assignment contexts and checks common leak locations including committed .env files, Docker ENV/ARG instructions, and CI workflow files. - Git History Auditing: Searches deleted env files and historical diffs for previously committed secrets, while distinguishing real credentials from safe test fixtures and placeholders. - Use Case: During a code review, spawn this specialist to scan all changed files, receive severity-classified findings (P0-P3) with masked value previews, and route results to the security-reviewer for remediation. ## Quick Start Ask the agent to scan the current branch's changed files and git history for hardcoded secrets and report any findings with severity ratings.
