This skill helps you identify potential security vulnerabilities in your workspace by scanning for hardcoded credentials, API keys, tokens, and other sensitive information that should not be committed to version control.
What It Scans For
The security scanner looks for common patterns of sensitive data:
Environment variable assignments with sensitive keys
Configuration files with credentials
How to Use
Basic Scan
Scan the entire workspace for all security risks:
# The assistant will:
# 1. Search for common secret patterns
# 2. Check for hardcoded credentials
# 3. Identify suspicious files (e.g., .env not in .gitignore)
# 4. Report findings with file locations and line numbers
Simply ask: "Run a security scan" or "Check for exposed secrets"
Targeted Scans
You can also request specific scans:
"Scan for API keys" - Focus on API key patterns
"Check for passwords" - Look for password patterns
"Find AWS credentials" - Search for AWS-specific secrets
"Scan database connection strings" - Find DB credentials
Custom Pattern Scan
Request a scan for specific patterns:
"Search for tokens matching pattern X"
"Find all base64 encoded strings longer than 40 characters"
Scan Process
When you invoke this skill, the assistant will:
Identify Scan Scope
Determine workspace boundaries
Exclude common directories (node_modules, .git, vendor, dist, build)
Respect .gitignore patterns
Pattern Matching
Use regex patterns to find sensitive data
Check file contents using grep/ripgrep
Flag suspicious variable names and comments
Contextual Analysis
Examine surrounding code for context
Identify if secrets are in test files (lower risk)
If secrets are in git history, rotate them immediately
Use tools like git-secrets or truffleHog for history scanning
Use Git Hooks
Install pre-commit hooks to prevent secret commits
Tools: pre-commit, detect-secrets, git-secrets
Files and Directories
This skill uses a scanning script located at:
scripts/scan_secrets.sh - Main scanning logic
Exclusions
The scanner automatically excludes:
node_modules/, vendor/, .git/
dist/, build/, target/
Binary files and large data files
Test fixtures with placeholder credentials
Documentation with example credentials (marked as such)
Best Practices
Regular Scans : Run security scans regularly, especially before commits
CI/CD Integration : Add secret scanning to your CI/CD pipeline
Developer Education : Ensure team knows not to commit secrets
Secret Rotation : Regularly rotate credentials and API keys
Least Privilege : Use minimal permissions for API keys and tokens
Limitations
False Positives : May flag test data or examples - use judgment
Encoded Secrets : May not catch all obfuscated or encrypted secrets
Custom Patterns : Very custom secret formats may not be detected
Performance : Large codebases may take time to scan
Security Note
⚠️ This skill scans local files only and does not transmit secrets anywhere. However, findings are shown in the assistant's output, so be cautious when sharing scan results.
Getting Started
To run your first security scan, simply say:
"Scan my workspace for security risks"
The assistant will scan your workspace and provide a detailed report of any potential security issues found.