Secrets management audit

Skill JeremyMorgan/code-review-skills/skills/secrets-management-audit

Scans the codebase for hardcoded secrets and weak secret handling, and checks rotation and key management. Use when auditing API keys, passwords, tokens, or secret storage.From its SKILL.md

Install

npx -y skills add JeremyMorgan/code-review-skills --skill secrets-management-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

12 stars12 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its file declares

Copied from the file, not written here

The file declares its own license as CC0-1.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.

SKILL.md

1.9 KB, as published. Nobody here has run it

Target: $ARGUMENTS

If no target path is given above, review the entire codebase.

Secrets Management Audit

Scan entire codebase for exposed secrets

Check for:

Hardcoded secrets
- API keys
- Database passwords
- JWT secrets
- Encryption keys
Environment variable usage
- All secrets in env vars
- .env file not in git
- Production vs development configs
Secret rotation capability
- Database password rotation
- API key rotation
- Certificate updates
Encryption key management
- Key derivation functions
- Salt usage
- Key storage

Flag any hardcoded secrets as CRITICAL.

Provide:

A structured finding report with the following for each issue:

Title, Severity (Critical/High/Medium/Low), CWE (if applicable), Evidence (file, function, line ranges), and a short Why it matters.

Exploitability notes and, where safe, a minimal PoC or reproduction steps (no real secrets).

Remediation: precise code-level fix or config change (snippets welcome), plus defense-in-depth guidance.

A summary risk score (0–10) and top 3–5 prioritized fixes that reduce risk fastest.

A checklist diff: which items from the “Check for” list are Pass/Fail/Not Applicable.

Constraints & style:

Be concrete and cite exact code locations and identifiers.

Prefer minimal, drop-in fix snippets over prose.

Do not invent files or functions that aren’t present; if context is missing, mark as Unable to verify and say what code would prove it.

Write this into a markdown file and place it in the audits/ folder.