How do I install the Security Secrets skill?

Run npx skillmds@latest add igorwarzocha/security-secrets in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Secrets safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Secrets?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Secrets free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Secrets?

igorwarzocha (@igorwarzocha) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Secrets by igorwarzocha — Agent Skill

Name: Security Secrets
Rating: 4.5 (4 reviews)
Author: igorwarzocha

Security Secrets

Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns

igorwarzocha dcc1a4d 3 files · 12.6 KB Updated Sep 9, 2026

File contents

High-signal regex patterns for detecting secrets in codebases.

High-Signal Regex Patterns

Secret Type	Pattern	Notes
AWS Access Key	`AKIA[0-9A-Z]{16}`	Always 20 chars, starts AKIA
AWS Secret	`(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]`	40 chars base64-ish
Google API Key	`AIza[0-9A-Za-z\-_]{35}`	39 chars total
Google OAuth	`[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com`	Client ID
Google Service Account	`"type":\s*"service_account"`	In JSON files
GitHub Token	`gh[pousr]_[A-Za-z0-9_]{36,}`	ghp_/gho_/ghu_/ghs_/ghr_
GitHub PAT (fine-grained)	`github_pat_[A-Za-z0-9_]{22,}`	Newer format
GitLab Token	`glpat-[A-Za-z0-9\-]{20,}`	Personal access token
Stripe Secret	`sk_(live	test)_[0-9a-zA-Z]{24,}`
Stripe Restricted	`rk_(live	test)_[0-9a-zA-Z]{24,}`
Stripe Publishable	`pk_(live	test)_[0-9a-zA-Z]{24,}`
Slack Bot Token	`xoxb-[A-Za-z0-9-]+`	Bot token
Slack User Token	`xoxp-[A-Za-z0-9-]+`	User token
Slack Workflow Token	`xwfp-[A-Za-z0-9-]+`	Workflow token
Slack App Token	`xapp-[A-Za-z0-9-]+`	App-level token
Slack Webhook	`https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+`
Discord Token	`[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}`	Bot token
Discord Webhook	`https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+`
OpenAI Key	`sk-[A-Za-z0-9]{48}`	API key
Anthropic Key	`sk-ant-[A-Za-z0-9\-]{32,}`	API key
Twilio	`SK[a-z0-9]{32}`	API key SID
SendGrid	`SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}`	API key
Mailgun	`key-[0-9a-zA-Z]{32}`	API key
Mailchimp	`[a-f0-9]{32}-us[0-9]{1,2}`	API key
Firebase	`(?i)firebase[a-z0-9\-]+\.firebaseio\.com`	Database URL
Supabase	`eyJ[A-Za-z0-9_-]\.[A-Za-z0-9_-]\.[A-Za-z0-9_-]*`	JWT (check context)
Heroku	`[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}`	API key
NPM Token	`npm_[A-Za-z0-9]{36}`	Publish token
PyPI Token	`pypi-[A-Za-z0-9_-]{50,}`	Upload token
Private Key	`-----BEGIN (RSA	EC
Database URL	`(?i)(postgres	mysql
Password in URL	`[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}`	Basic auth
JWT Secret	`(?i)(jwt[_-]?secret	token[_-]?secret)['"]?\s[:=]\s['"][^'"]+['"]`
Generic Secret	`(?i)(password	passwd

CLI Scanning Commands

# Quick grep scan (fast, high signal)
rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" .
rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" .
rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" .

# Dedicated scanners (thorough)
gitleaks detect --source . --redact --no-git
semgrep scan --config p/secrets --error
trufflehog filesystem . --only-verified

Files to Prioritize

File Pattern	Risk Level	Why
`.env*`	CRITICAL	Often contains all secrets
`config.js/ts/json`	HIGH	App configuration
`secret`, `credential`	HIGH	Named suspiciously
`docker-compose*.yml`	HIGH	DB passwords, service creds
`.github/workflows/*.yml`	HIGH	CI/CD secrets
`test`, `spec`, `fixture`	MEDIUM	Test data with real creds
`.pem`, `.key`, `*.p12`	CRITICAL	Private keys

Redaction Format

When reporting secrets, MUST always redact:

Original: AKIAIOSFODNN7EXAMPLE
Redacted: AKIA****...****MPLE

Original: sk_test_XXXXYYYYZZZZ11112222
Redacted: sk_****...****2222

Show first 4 + last 4 characters only. MUST instruct immediate rotation.

---name: security-secretsdescription: Review secret detection patterns and scanning workflows. Use for identifying high-signal secrets like AWS keys, GitHub tokens, and DB passwords. Use proactively during all security audits to scan code and history. Examples: - user: "Scan for secrets in this repo" → run high-signal rg patterns and gitleaks - user: "Check for AWS keys" → scan for AKIA patterns and server-side exposure - user: "Audit my .env files" → ensure secrets are gitignored and not committed - user: "Verify secret redaction" → check that reported secrets follow 4+4 format - user: "Scan build artifacts for keys" → search dist/ and build/ for secret patterns--- <overview> High-signal regex patterns for detecting secrets in codebases. </overview> <patterns> ## High-Signal Regex Patterns | Secret Type | Pattern | Notes | |-------------|---------|-------| | AWS Access Key | `AKIA[0-9A-Z]{16}` | Always 20 chars, starts AKIA | | AWS Secret | `(?i)aws(.{0,20})?['"][0-9a-zA-Z/+]{40}['"]` | 40 chars base64-ish | | Google API Key | `AIza[0-9A-Za-z\-_]{35}` | 39 chars total | | Google OAuth | `[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com` | Client ID | | Google Service Account | `"type":\s*"service_account"` | In JSON files | | GitHub Token | `gh[pousr]_[A-Za-z0-9_]{36,}` | ghp_/gho_/ghu_/ghs_/ghr_ | | GitHub PAT (fine-grained) | `github_pat_[A-Za-z0-9_]{22,}` | Newer format | | GitLab Token | `glpat-[A-Za-z0-9\-]{20,}` | Personal access token | | Stripe Secret | `sk_(live|test)_[0-9a-zA-Z]{24,}` | Secret key | | Stripe Restricted | `rk_(live|test)_[0-9a-zA-Z]{24,}` | Restricted key | | Stripe Publishable | `pk_(live|test)_[0-9a-zA-Z]{24,}` | Public key | | Slack Bot Token | `xoxb-[A-Za-z0-9-]+` | Bot token | | Slack User Token | `xoxp-[A-Za-z0-9-]+` | User token | | Slack Workflow Token | `xwfp-[A-Za-z0-9-]+` | Workflow token | | Slack App Token | `xapp-[A-Za-z0-9-]+` | App-level token | | Slack Webhook | `https://hooks\.slack\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+` | | | Discord Token | `[MN][A-Za-z\d]{23,}\.[\w-]{6}\.[\w-]{27}` | Bot token | | Discord Webhook | `https://discord\.com/api/webhooks/[0-9]+/[A-Za-z0-9_-]+` | | | OpenAI Key | `sk-[A-Za-z0-9]{48}` | API key | | Anthropic Key | `sk-ant-[A-Za-z0-9\-]{32,}` | API key | | Twilio | `SK[a-z0-9]{32}` | API key SID | | SendGrid | `SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}` | API key | | Mailgun | `key-[0-9a-zA-Z]{32}` | API key | | Mailchimp | `[a-f0-9]{32}-us[0-9]{1,2}` | API key | | Firebase | `(?i)firebase[a-z0-9\-]+\.firebaseio\.com` | Database URL | | Supabase | `eyJ[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*\.[A-Za-z0-9_-]*` | JWT (check context) | | Heroku | `[hH]eroku.*[0-9A-F]{8}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{4}-[0-9A-F]{12}` | API key | | NPM Token | `npm_[A-Za-z0-9]{36}` | Publish token | | PyPI Token | `pypi-[A-Za-z0-9_-]{50,}` | Upload token | | Private Key | `-----BEGIN (RSA|EC|DSA|OPENSSH|PGP) PRIVATE KEY` | Any private key | | Database URL | `(?i)(postgres|mysql|mongodb|redis|amqp)://[^:]+:[^@]+@` | With password | | Password in URL | `[a-zA-Z]{3,15}://[^/\\:@]+:[^/\\:@]+@.{1,100}` | Basic auth | | JWT Secret | `(?i)(jwt[_-]?secret|token[_-]?secret)['"]?\s*[:=]\s*['"][^'"]+['"]` | Config files | | Generic Secret | `(?i)(password|passwd|secret|api_key|apikey|access_token|auth_token)['"]?\s*[:=]\s*['"][^'"]{8,}['"]` | Catch-all | </patterns> <commands> ## CLI Scanning Commands ```bash # Quick grep scan (fast, high signal) rg -n "(AKIA[0-9A-Z]{16}|sk_(live|test)_|rk_(live|test)_|pk_(live|test)_|xox[baprs]-|xapp-|xwfp-|gh[pousr]_|github_pat_)" . rg -n "BEGIN (RSA|EC|OPENSSH|DSA|PGP) PRIVATE KEY" . rg -n "(?i)(api[_-]?key|secret|token|password)\s*[:=]\s*['\"][^'\"]{8,}" . # Dedicated scanners (thorough) gitleaks detect --source . --redact --no-git semgrep scan --config p/secrets --error trufflehog filesystem . --only-verified ``` </commands> <priority_files> ## Files to Prioritize | File Pattern | Risk Level | Why | |--------------|------------|-----| | `.env*` | CRITICAL | Often contains all secrets | | `*config*.js/ts/json` | HIGH | App configuration | | `*secret*`, `*credential*` | HIGH | Named suspiciously | | `docker-compose*.yml` | HIGH | DB passwords, service creds | | `.github/workflows/*.yml` | HIGH | CI/CD secrets | | `*test*`, `*spec*`, `*fixture*` | MEDIUM | Test data with real creds | | `*.pem`, `*.key`, `*.p12` | CRITICAL | Private keys | </priority_files> <rules> ## Redaction Format When reporting secrets, MUST always redact: ``` Original: AKIAIOSFODNN7EXAMPLE Redacted: AKIA****...****MPLE Original: sk_test_XXXXYYYYZZZZ11112222 Redacted: sk_****...****2222 ``` Show first 4 + last 4 characters only. MUST instruct immediate rotation. </rules>

Frequently asked questions