Installs into .claude/skills of the current project.
Are you the author of Secret Scan?
Add the live security badge to your README. It updates with every re-scan.
[](https://www.skillsdirectory.com/skills/berkcangumusisik-secret-scan)
---
name: secret-scan
description: Scans the codebase for accidentally committed secrets, tokens, and credentials
user-invocable: true
allowed-tools: Bash Grep Read
effort: low
---
## Secret Scanner
```bash
# Common secret patterns
grep -rn \
-e "password\s*=\s*['\"][^'\"]\+" \
-e "secret\s*=\s*['\"][^'\"]\+" \
-e "api_key\s*=\s*['\"][^'\"]\+" \
-e "token\s*=\s*['\"][^'\"]\+" \
-e "sk-[a-zA-Z0-9]\{20,\}" \
-e "ghp_[a-zA-Z0-9]\{36\}" \
-e "AKIA[0-9A-Z]\{16\}" \
-e "-----BEGIN.*PRIVATE KEY-----" \
--include="*.ts" --include="*.js" --include="*.env*" --include="*.json" \
--exclude-dir=node_modules --exclude-dir=dist \
. 2>/dev/null | grep -v "\.test\." | grep -v "example\|placeholder\|your_key_here"
```
Also check:
```bash
git log --all --full-history -- "*.env" | head -10
git log --diff-filter=D --summary | grep ".env" | head -10
```
For each finding:
- Show file, line, and the leaked value (partially redacted)
- Confirm if it's a real secret or a false positive
- If real: advise rotating the credential immediately, then removing from git history
**Note:** Rotate first, remove from history second - a removed commit is not the same as a revoked token.
