重要前提
安装AI Skills的关键前提是:必须科学上网,且开启TUN模式,这一点至关重要,直接决定安装能否顺利完成,在此郑重提醒三遍:科学上网,科学上网,科学上网。查看完整安装教程 →
secrets-scan by jwynia/agent-skills
npx skills add https://github.com/jwynia/agent-skills --skill secrets-scan深度检测源代码中的硬编码凭据和敏感数据。
/secrets-scan # 扫描当前目录
/secrets-scan --scope src/ # 扫描指定路径
/secrets-scan --entropy # 包含高熵值检测
/secrets-scan --git-history # 检查 git 提交历史
误报率极低的模式:
| 类型 | 模式示例 | 提供商 |
|---|---|---|
| AWS 访问密钥 | AKIA... (20 个字符) | AWS |
| AWS 密钥 | 40 个字符的 base64 | AWS |
| GitHub 令牌 | ghp_, gho_, , , |
广告位招租
在这里展示您的产品或服务
触达数万 AI 开发者,精准高效
ghu_ghs_ghr_| GitHub |
| GitLab 令牌 | glpat-... | GitLab |
| Slack 令牌 | xoxb-, xoxp-, xoxa- | Slack |
| Stripe 密钥 | sk_live_, rk_live_ | Stripe |
| Twilio | SK... (34 个字符) | Twilio |
| SendGrid | SG. 后跟 base64 | SendGrid |
| 私钥 | `-----BEGIN (RSA | EC |
| Google API 密钥 | AIza... (39 个字符) |
可能需要上下文验证:
| 类型 | 模式 | 备注 |
|---|---|---|
| 通用 API 密钥 | api[_-]?key.*=.*['"][a-zA-Z0-9]{16,} | 变量名 |
| 通用密钥 | secret.*=.*['"][^'"]+ | 需要上下文 |
| 密码 | password.*=.*['"][^'"]+ | 可能是配置 |
| 连接字符串 | ://[^:]+:[^@]+@ | 数据库凭据 |
| Bearer 令牌 | Bearer [a-zA-Z0-9_-]+ | 在头部/代码中 |
通过熵分析查找潜在的密钥:
/secrets-scan --entropy
检测具有高随机性的字符串,可能是:
# AWS
AKIA[0-9A-Z]{16} # 访问密钥 ID
[A-Za-z0-9/+=]{40} # 密钥访问密钥(需要上下文)
# Azure
[a-zA-Z0-9+/=]{88} # 存储账户密钥
# GCP
AIza[0-9A-Za-z_-]{35} # API 密钥
[0-9]+-[a-z0-9]{32}\.apps\.googleusercontent\.com # OAuth 客户端
# GitHub
gh[pousr]_[A-Za-z0-9]{36,} # 个人/OAuth/用户/仓库/应用令牌
github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59} # 细粒度个人访问令牌
# GitLab
glpat-[A-Za-z0-9-_]{20,} # 个人访问令牌
# Bitbucket
[a-zA-Z0-9]{24} # 应用密码(需要上下文)
# Stripe
sk_live_[a-zA-Z0-9]{24,} # 密钥
rk_live_[a-zA-Z0-9]{24,} # 受限密钥
pk_live_[a-zA-Z0-9]{24,} # 可发布密钥
# Square
sq0[a-z]{3}-[A-Za-z0-9_-]{22,} # 访问令牌
# PayPal
access_token\$[a-zA-Z0-9-_.]+ # OAuth 令牌
# Slack
xox[bpas]-[0-9]{10,}-[a-zA-Z0-9]{24,} # 机器人/用户/应用令牌
# Twilio
SK[a-f0-9]{32} # API 密钥 SID
[a-f0-9]{32} # 认证令牌(需要上下文)
# SendGrid
SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43} # API 密钥
# PostgreSQL/MySQL
(postgres|mysql|mariadb)://[^:]+:[^@]+@[^/]+/\w+
# MongoDB
mongodb(\+srv)?://[^:]+:[^@]+@
# Redis
redis://:[^@]+@
-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
-----BEGIN PGP PRIVATE KEY BLOCK-----
eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+ # JWT
/secrets-scan
仅扫描高置信度模式。
/secrets-scan --entropy
添加高熵值字符串检测(发现更多,但可能存在误报)。
/secrets-scan --scope src/api/
/secrets-scan --scope "*.ts"
/secrets-scan --git-history
/secrets-scan --git-history --since "2024-01-01"
扫描提交历史,查找曾被提交但后来被移除的密钥。
/secrets-scan --exclude "*.test.ts" --exclude "fixtures/"
SECRETS SCAN RESULTS
====================
High-Confidence Findings: 2
Medium-Confidence Findings: 5
Entropy Findings: 3
[!] CRITICAL: AWS Access Key
File: src/config/aws.ts:15
Pattern: AKIAIOSFODNN7EXAMPLE
Action: Rotate immediately, check CloudTrail
[!] CRITICAL: GitHub Token
File: .env.example:8
Pattern: ghp_xxxx...xxxx (redacted)
Action: Revoke token, remove from history
[H] HIGH: Database Password
File: docker-compose.yml:23
Pattern: password: supersecret
Action: Use environment variable
[M] MEDIUM: Possible API Key
File: src/services/api.ts:44
Pattern: apiKey = "a1b2c3..."
Context: May be test value
Files scanned: 342
Patterns checked: 127
Time elapsed: 2.3s
By Severity:
Critical: 2
High: 5
Medium: 8
By Type:
Cloud credentials: 2
API keys: 4
Passwords: 3
Private keys: 1
Other: 5
示例/占位符值
AKIAIOSFODNN7EXAMPLE (AWS 示例)sk_test_... (Stripe 测试密钥)your-api-key-here测试夹具
文档
创建 .secrets-scan-ignore:
# Ignore test fixtures
**/fixtures/**
**/__mocks__/**
*.test.ts
*.spec.js
# Ignore documentation
docs/**
*.md
# Ignore specific false positives
src/constants.ts:EXAMPLE_KEY
# Inline ignore comment
# secrets-scan-ignore: test fixture
// secrets-scan-ignore: example value
const EXAMPLE_KEY = "AKIAIOSFODNN7EXAMPLE";
立即行动
清理 Git 历史
# 从历史中移除密钥
git filter-branch --force --index-filter \
'git rm --cached --ignore-unmatch path/to/file' \
--prune-empty --tag-name-filter cat -- --all
# 或使用 BFG Repo Cleaner
bfg --replace-text secrets.txt repo.git
防止未来提交
# 安装预提交钩子
npx husky add .husky/pre-commit "npx secrets-scan --staged"
# GitHub Actions
- name: Secrets Scan
run: |
/secrets-scan --fail-on-findings
exit $?
# Exit codes:
# 0 = No findings
# 1 = Findings detected
# 2 = Error during scan
#!/bin/sh
# .husky/pre-commit
files=$(git diff --cached --name-only)
/secrets-scan --files "$files"
/security-scan - 完整安全分析/config-scan - 配置安全/dependency-scan - 包漏洞每周安装
66
仓库
GitHub 星标
37
首次出现
2026年2月15日
安全审计
安装于
codex61
github-copilot59
gemini-cli58
opencode57
amp56
kimi-cli56
Deep detection of hardcoded credentials and sensitive data in source code.
/secrets-scan # Scan current directory
/secrets-scan --scope src/ # Scan specific path
/secrets-scan --entropy # Include high-entropy detection
/secrets-scan --git-history # Check git commit history
Patterns with very low false positive rates:
| Type | Pattern Example | Provider |
|---|---|---|
| AWS Access Key | AKIA... (20 chars) | AWS |
| AWS Secret Key | 40 char base64 | AWS |
| GitHub Token | ghp_, gho_, ghu_, ghs_, ghr_ | GitHub |
| GitLab Token | glpat-... | GitLab |
| Slack Token | xoxb-, xoxp-, xoxa- | Slack |
| Stripe Key | sk_live_, rk_live_ | Stripe |
| Twilio | SK... (34 chars) | Twilio |
| SendGrid | SG. followed by base64 | SendGrid |
| Private Key | `-----BEGIN (RSA | EC |
| Google API Key | AIza... (39 chars) |
May require context validation:
| Type | Pattern | Notes |
|---|---|---|
| Generic API Key | api[_-]?key.*=.*['"][a-zA-Z0-9]{16,} | Variable names |
| Generic Secret | secret.*=.*['"][^'"]+ | Context needed |
| Password | password.*=.*['"][^'"]+ | May be config |
| Connection String | ://[^:]+:[^@]+@ | DB credentials |
| Bearer Token | Bearer [a-zA-Z0-9_-]+ |
Finds potential secrets via entropy analysis:
/secrets-scan --entropy
Detects strings with high randomness that may be:
# AWS
AKIA[0-9A-Z]{16} # Access Key ID
[A-Za-z0-9/+=]{40} # Secret Access Key (context needed)
# Azure
[a-zA-Z0-9+/=]{88} # Storage Account Key
# GCP
AIza[0-9A-Za-z_-]{35} # API Key
[0-9]+-[a-z0-9]{32}\.apps\.googleusercontent\.com # OAuth Client
# GitHub
gh[pousr]_[A-Za-z0-9]{36,} # Personal/OAuth/User/Repo/App
github_pat_[A-Za-z0-9]{22}_[A-Za-z0-9]{59} # Fine-grained PAT
# GitLab
glpat-[A-Za-z0-9-_]{20,} # Personal Access Token
# Bitbucket
[a-zA-Z0-9]{24} # App Password (context needed)
# Stripe
sk_live_[a-zA-Z0-9]{24,} # Secret Key
rk_live_[a-zA-Z0-9]{24,} # Restricted Key
pk_live_[a-zA-Z0-9]{24,} # Publishable Key
# Square
sq0[a-z]{3}-[A-Za-z0-9_-]{22,} # Access Token
# PayPal
access_token\$[a-zA-Z0-9-_.]+ # OAuth Token
# Slack
xox[bpas]-[0-9]{10,}-[a-zA-Z0-9]{24,} # Bot/User/App Token
# Twilio
SK[a-f0-9]{32} # API Key SID
[a-f0-9]{32} # Auth Token (context)
# SendGrid
SG\.[a-zA-Z0-9_-]{22}\.[a-zA-Z0-9_-]{43} # API Key
# PostgreSQL/MySQL
(postgres|mysql|mariadb)://[^:]+:[^@]+@[^/]+/\w+
# MongoDB
mongodb(\+srv)?://[^:]+:[^@]+@
# Redis
redis://:[^@]+@
-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
-----BEGIN PGP PRIVATE KEY BLOCK-----
eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+ # JWT
/secrets-scan
Scans for high-confidence patterns only.
/secrets-scan --entropy
Adds high-entropy string detection (more findings, some false positives).
/secrets-scan --scope src/api/
/secrets-scan --scope "*.ts"
/secrets-scan --git-history
/secrets-scan --git-history --since "2024-01-01"
Scans commit history for secrets that were committed and later removed.
/secrets-scan --exclude "*.test.ts" --exclude "fixtures/"
SECRETS SCAN RESULTS
====================
High-Confidence Findings: 2
Medium-Confidence Findings: 5
Entropy Findings: 3
[!] CRITICAL: AWS Access Key
File: src/config/aws.ts:15
Pattern: AKIAIOSFODNN7EXAMPLE
Action: Rotate immediately, check CloudTrail
[!] CRITICAL: GitHub Token
File: .env.example:8
Pattern: ghp_xxxx...xxxx (redacted)
Action: Revoke token, remove from history
[H] HIGH: Database Password
File: docker-compose.yml:23
Pattern: password: supersecret
Action: Use environment variable
[M] MEDIUM: Possible API Key
File: src/services/api.ts:44
Pattern: apiKey = "a1b2c3..."
Context: May be test value
Files scanned: 342
Patterns checked: 127
Time elapsed: 2.3s
By Severity:
Critical: 2
High: 5
Medium: 8
By Type:
Cloud credentials: 2
API keys: 4
Passwords: 3
Private keys: 1
Other: 5
Example/placeholder values
AKIAIOSFODNN7EXAMPLE (AWS example)sk_test_... (Stripe test key)your-api-key-hereTest fixtures
Documentation
Create .secrets-scan-ignore:
# Ignore test fixtures
**/fixtures/**
**/__mocks__/**
*.test.ts
*.spec.js
# Ignore documentation
docs/**
*.md
# Ignore specific false positives
src/constants.ts:EXAMPLE_KEY
# Inline ignore comment
# secrets-scan-ignore: test fixture
// secrets-scan-ignore: example value
const EXAMPLE_KEY = "AKIAIOSFODNN7EXAMPLE";
Immediate Actions
Clean Git History
# Remove secret from history
git filter-branch --force --index-filter \
'git rm --cached --ignore-unmatch path/to/file' \
--prune-empty --tag-name-filter cat -- --all
# Or use BFG Repo Cleaner
bfg --replace-text secrets.txt repo.git
Prevent Future Commits
# Install pre-commit hook
npx husky add .husky/pre-commit "npx secrets-scan --staged"
# GitHub Actions
- name: Secrets Scan
run: |
/secrets-scan --fail-on-findings
exit $?
# Exit codes:
# 0 = No findings
# 1 = Findings detected
# 2 = Error during scan
#!/bin/sh
# .husky/pre-commit
files=$(git diff --cached --name-only)
/secrets-scan --files "$files"
/security-scan - Full security analysis/config-scan - Configuration security/dependency-scan - Package vulnerabilitiesWeekly Installs
66
Repository
GitHub Stars
37
First Seen
Feb 15, 2026
Security Audits
Gen Agent Trust HubPassSocketPassSnykFail
Installed on
codex61
github-copilot59
gemini-cli58
opencode57
amp56
kimi-cli56
| In headers/code |