mcpField
S
secret-leak-detector

secret-leak-detector

github.com/jorgealvesSecurity2230 installsUpdated 2d ago
Repository

About secret-leak-detector

A local skill for scanning source and configuration files for hardcoded secrets, aimed at developers and repository audits. It can also inspect Git history and masks findings in its output.

Key features

  1. 01Scan files for credentials and tokens
  2. 02Inspect Git history for deleted secrets
  3. 03Report file, line, type, and risk
  4. 04Mask secret snippets in results
  5. 05Run locally without uploading code

Use cases

  1. 01Check changes before committing
  2. 02Block secrets in CI/CD pipelines
  3. 03Audit Git history for past leaks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/jorgealves/agent_skills --skill secret-leak-detector

After installing, type/secret-leak-detectorin Claude Code to confirm it loaded.

Bundled filesskill.yaml

Details

From the project README

Secret Leak Detector

Purpose and Intent

The secret-leak-detector is designed to safeguard repositories by identifying hardcoded sensitive information such as API keys, database credentials, and authentication tokens before they are committed or after they have been accidentally pushed to history.

When to Use

  • Pre-commit Checks: Run this skill before committing changes to ensure no secrets are being introduced.
  • CI/CD Pipelines: Integrate into automated pipelines to block builds that contain plain-text secrets.
  • Legacy Audits: Use with scan_history: true to perform a deep audit of a project's entire history to find secrets that were deleted but still exist in git logs.

When NOT to Use

  • Production Logs: This tool is for source code and config files; it is not optimized for scanning terabytes of runtime logs.
  • Binary Files: It will not effectively detect secrets inside compiled binaries or encrypted blobs.

Input and Output Examples

Input
directory_path: "./config"
scan_history: false
Output
{
  "leaks": [
    {
      "file": "config/production.yaml",
      "line": 45,
      "type": "Stripe Secret Key",
      "risk_level": "critical",
      "snippet": "sk_live_**********"
    }
  ]
}

Error Conditions and Edge Cases

  • False Positives: High-entropy strings in test data or encrypted hashes may be flagged as secrets.
  • Git Repository Required: If scan_history is true, the target directory must be a valid git repository.
  • Permission Denied: The skill will fail if it lacks read permissions for specific files or the .git directory.

Security and Data-Handling Considerations

  • No Persistence: This skill does not store the secrets it finds.
  • Masking: Output snippets are masked to prevent the tool itself from becoming a source of leaks in logs or terminal history.
  • Local Execution: The skill runs locally and does not phone home or upload code to third-party services.

Comments

Markdown supported