Secrets Detection

Name: Secrets Detection
Author: awarexone

ASecurity

Find and triage hard-coded secrets, tokens, and credentials in source and build artifacts before ship (CWE-798 / A07:2021 adjacent).

15 stars

0 votes

0 copies

0 views

Added 9/22/2026

securitygogitapisecurity

Works with

cliapi

Security Analysis

A100/100

Scanned 9/22/2026

Install to Claude Code

$npx -y skills add awarexone/AXguard --skill secrets-detection --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Secrets Detection?

Add the live security badge to your README — it updates automatically with every re-scan.

Security grade badge for Secrets Detection

[![Security: A — Skills Directory](https://www.skillsdirectory.com/api/skills/awarexone-secrets-detection/badge)](https://www.skillsdirectory.com/skills/awarexone-secrets-detection)

More formats (shields.io, HTML) on the badges page.

Download Zip

Files

SKILL.md

---
name: secrets-detection
description: Find and triage hard-coded secrets, tokens, and credentials in source and build artifacts before ship (CWE-798 / A07:2021 adjacent).
version: "1.0.0"
author: AwareXone
license: MIT
domain: infrastructure
subcategory: secrets
tags: [secrets, credentials, cwe-798]
frameworks:
  cwe: [CWE-798]
  owasp_top10: [A07:2021]
  owasp_api_top10: []
  owasp_llm_top10: []
  owasp_wstg: []
  owasp_asvs: []
  mitre_attack: []
  mitre_atlas: []
  nist_csf: []
  nist_ai_rmf: []
related_skills: [supply-chain-security, cloud-security, security-triage, security-remediation]
related_commands: [/axguard-secrets, /axguard-audit]
related_rules: [secrets.]
references:
  - https://cwe.mitre.org/data/definitions/798.html
  - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/
last_reviewed: "2026-09-15"
---

# Secrets Detection

## Purpose

Detect credentials committed to repositories or artifacts and drive safe rotation + removal workflows.

## When to Use

- Pre-ship / PR review
- After `axguard` `secrets.*` hits
- Incident suspicion of leaked keys

## When Not to Use

- Scanning systems without authorization
- Printing full live secrets into chat/logs (always redact)

## Analysis Workflow

1. Run `axguard scan` / `audit`; collect `secrets.*`.
2. Classify: cloud keys, GitHub/Slack tokens, PEM private keys, generic API keys.
3. Decide if value is a real secret vs fixture/example (`EXAMPLE`, `changeme`, obviously fake).
4. If real: treat as incident — rotate first, then remove from git history if needed.
5. Check build artifacts and client bundles, not only server source.

## Evidence Requirements

- File:line
- Secret class (not full value)
- Whether it appears active (best-effort; do not exercise stolen creds against third parties)

## False Positive Controls

- Documented placeholders in fixtures
- Public test keys clearly marked
- `.env.example` with empty values

## Remediation

- Remove secret; rotate at provider
- Load via env / secret manager
- Add pre-commit secret scanning
- Ensure CI does not echo secrets

## Verification

Confirm file gone, rotation done, `axguard` no longer flags the live material, history cleaned if it was committed.

## Framework Mapping

- CWE-798
- OWASP A07:2021 (auth failures — credential exposure contributes)

## References

- https://cwe.mitre.org/data/definitions/798.html
- https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/

## Research Provenance

Primary: CWE-798; OWASP Top 10:2021 A07 (2026-09-15).  
Internal: AXGuard `rules/secrets.json`.

Attribution

awarexone

View source More from awarexone →

SSkills DirectorySkills Directory

Ship a skill? Prove it's safe.

Free 120-pattern security scan, letter grade, and an embeddable README badge.

Submit a skill

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

Comments (0)

No comments yet. Be the first to comment!

--- name: secrets-detection description: Find and triage hard-coded secrets, tokens, and credentials in source and build artifacts before ship (CWE-798 / A07:2021 adjacent). version: "1.0.0" author: AwareXone license: MIT domain: infrastructure subcategory: secrets tags: [secrets, credentials, cwe-798] frameworks: cwe: [CWE-798] owasp_top10: [A07:2021] owasp_api_top10: [] owasp_llm_top10: [] owasp_wstg: [] owasp_asvs: [] mitre_attack: [] mitre_atlas: [] nist_csf: [] nist_ai_rmf: [] related_skills: [supply-chain-security, cloud-security, security-triage, security-remediation] related_commands: [/axguard-secrets, /axguard-audit] related_rules: [secrets.] references: - https://cwe.mitre.org/data/definitions/798.html - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ last_reviewed: "2026-09-15" --- # Secrets Detection ## Purpose Detect credentials committed to repositories or artifacts and drive safe rotation + removal workflows. ## When to Use - Pre-ship / PR review - After `axguard` `secrets.*` hits - Incident suspicion of leaked keys ## When Not to Use - Scanning systems without authorization - Printing full live secrets into chat/logs (always redact) ## Analysis Workflow 1. Run `axguard scan` / `audit`; collect `secrets.*`. 2. Classify: cloud keys, GitHub/Slack tokens, PEM private keys, generic API keys. 3. Decide if value is a real secret vs fixture/example (`EXAMPLE`, `changeme`, obviously fake). 4. If real: treat as incident — rotate first, then remove from git history if needed. 5. Check build artifacts and client bundles, not only server source. ## Evidence Requirements - File:line - Secret class (not full value) - Whether it appears active (best-effort; do not exercise stolen creds against third parties) ## False Positive Controls - Documented placeholders in fixtures - Public test keys clearly marked - `.env.example` with empty values ## Remediation - Remove secret; rotate at provider - Load via env / secret manager - Add pre-commit secret scanning - Ensure CI does not echo secrets ## Verification Confirm file gone, rotation done, `axguard` no longer flags the live material, history cleaned if it was committed. ## Framework Mapping - CWE-798 - OWASP A07:2021 (auth failures — credential exposure contributes) ## References - https://cwe.mitre.org/data/definitions/798.html - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures/ ## Research Provenance Primary: CWE-798; OWASP Top 10:2021 A07 (2026-09-15). Internal: AXGuard `rules/secrets.json`.