How do I install the Code Review Secrets Detection skill?

Run npx skillmds@latest add noorqureshi/code-review-secrets-detection in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Code Review Secrets Detection safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Code Review Secrets Detection?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Code Review Secrets Detection free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Code Review Secrets Detection?

NoorQureshi (@noorqureshi) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Code Review Secrets Detection by noorqureshi

Name: Code Review Secrets Detection
Author: NoorQureshi

Code Review Secrets Detection

Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords.

NoorQureshi 38bce2e 1.9 KB Updated Sep 17, 2026

File contents

Secrets detection

When it applies

Any source you can read: an in-scope repo, an exposed .git/ on a web server, public GitHub repos of the org, or CI/CD config. Live secrets are direct, high-impact findings.

Why it works

Secrets get committed and then "removed" — but git keeps history, so they persist in old commits, branches, and stashes. Config/CI files and client bundles also embed keys that ship to users.

Method

Scan history, not just HEAD: trufflehog git file://. --only-verified or gitleaks detect --source . -v — these walk every commit and (trufflehog) verify keys live.
Exposed .git on a target: git-dumper http://target/.git/ out/ then scan the recovered repo.
Org-wide OSINT: GitHub dorks / trufflehog github --org=<org> for public leaks (in scope only).
Client-side & config: grep JS bundles, mobile apps, .env, Dockerfiles, k8s manifests, CI YAML for keys and tokens.
Validate & scope impact: confirm the key works with a read-only call (e.g. aws sts get-caller-identity) — a live, privileged key is the report; a dead one is informational.

Gotchas

Report verified/live secrets; example/placeholder keys inflate severity and get closed as N/A.
Rotate-awareness: note it may be live now; don't exfiltrate data with it — prove access, stop.
Deleted-from-HEAD ≠ gone — always scan full history.

Verify success

A secret that authenticates successfully (minimal proof), with where it lives (commit/file) — don't paste the secret value into reports, reference its location.

References

trufflehog & gitleaks docs; GitHub secret-scanning; OWASP secrets management.

---name: code-review-secrets-detectiondescription: Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords.---# Secrets detection## When it appliesAny source you can read: an in-scope repo, an exposed `.git/` on a web server, public GitHubrepos of the org, or CI/CD config. Live secrets are direct, high-impact findings.## Why it worksSecrets get committed and then "removed" — but git keeps history, so they persist in oldcommits, branches, and stashes. Config/CI files and client bundles also embed keys that ship to users.## Method1. **Scan history, not just HEAD**: `trufflehog git file://. --only-verified` or `gitleaks detect --source . -v` — these walk every commit and (trufflehog) verify keys live.2. **Exposed .git on a target**: `git-dumper http://target/.git/ out/` then scan the recovered repo.3. **Org-wide OSINT**: GitHub dorks / `trufflehog github --org=<org>` for public leaks (in scope only).4. **Client-side & config**: grep JS bundles, mobile apps, `.env`, Dockerfiles, k8s manifests, CI YAML for keys and tokens.5. **Validate & scope impact**: confirm the key works with a read-only call (e.g. `aws sts get-caller-identity`) — a live, privileged key is the report; a dead one is informational.## Gotchas- Report *verified/live* secrets; example/placeholder keys inflate severity and get closed as N/A.- Rotate-awareness: note it may be live now; don't exfiltrate data with it — prove access, stop.- Deleted-from-HEAD ≠ gone — always scan full history.## Verify successA secret that authenticates successfully (minimal proof), with where it lives (commit/file) —don't paste the secret value into reports, reference its location.## Referencestrufflehog & gitleaks docs; GitHub secret-scanning; OWASP secrets management.

Frequently asked questions