# Detect Secrets

> Use this skill when the user wants to scan code for secrets, API keys, tokens, passwords, or private keys — or integrate secret detection into CI/CD pipelines.

- Skill: `javimosch/detect-secrets` (Agent Skill)
- Install (CLI): `npx skillmds@latest add javimosch/detect-secrets`
- Raw SKILL.md: https://api.skillmd.com/api/skills/javimosch/detect-secrets/raw
- Safety review: PASS (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: DevOps & Infra
- Author: javimosch (https://skillmd.com/u/javimosch)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/javimosch/detect-secrets

---


# detect-secrets Plugin

detect-secrets scans codebases for secrets, API keys, tokens, and credentials. Supports baseline files for tracking known secrets and pre-commit hooks.

## Commands

- `detect-secrets _ _ <args>` — Passthrough

## Usage Examples

- "scan the current directory for secrets"
- "generate a baseline of known secrets"
- "audit potential secrets from a baseline scan"
- "scan only staged files before commit"

## Installation

```bash
pip install detect-secrets
```

## Key Features
- Detects API keys, tokens, private keys, passwords, and credentials
- Baseline file support for tracking known/approved secrets
- Pre-commit hook integration
- JSON output for CI/CD pipeline integration
- Plugable plugin system for custom secret types
- Audit mode for reviewing potential secrets
- Multiple file format support