agentsclimarketplace

Secret detection

Skill ShieldNet-360/secure-vibe/dist/agent-skills/.agents/skills/secret-detection

SecureVibe — prevention-first security for AI-written code. Signed SKILL.md knowledge that makes AI coding assistants write secure code at generation time, plus a deterministic CI gate. Offline · keyless · Ed25519-signed. By ShieldNet360.

Install
npx -y skills add ShieldNet-360/secure-vibe --skill secret-detection

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Detect and prevent hardcoded secrets, API keys, tokens, and credentials in code — Applies to: before every commit; when reviewing code that handles credentials; when writing configuration files; when creating .env or config templates

SKILL.md

3.6 KB, 934 tokens by cl100k_base, as published. Nobody here has run it

<!-- Native skill bundle for agent-skills (cross-tool convention). Generated by `secure-vibe dev regenerate`. --> <!-- Do not edit by hand; the source of truth is skills/secret-detection/SKILL.md. -->

Secret Detection

Detect and prevent hardcoded secrets, API keys, tokens, and credentials in code

ALWAYS

  • Check all string literals longer than 20 characters near keywords: api_key, secret, token, password, credential, auth, bearer, private_key, access_key, client_secret, refresh_token.
  • Flag any string matching known secret patterns. The bundled pattern set covers AWS (AKIA...), GitHub classic (ghp_, gho_) and fine-grained (github_pat_) PATs, OpenAI (sk-), Anthropic (sk-ant-api03-), Slack (xox[baprs]-), Stripe (sk_live_), Google (AIza...), Azure AD client secrets, Databricks (dapi), Datadog 32-hex with hotword, Twilio (SK), SendGrid (SG.), npm (npm_), PyPI upload (pypi-AgEI), Heroku UUID with hotword, DigitalOcean (dop_v1_), HashiCorp Vault (hvs.), Supabase (sbp_), Linear (lin_api_), JWT, and PEM private keys.
  • Verify .gitignore includes: *.pem, *.key, .env, .env.*, *credentials*, *secret*, id_rsa*, *.ppk.
  • Prefer environment variable usage (os.environ, process.env, os.Getenv) over hardcoded values for any credential, connection string, or API endpoint that has an attached secret.
  • Suggest a secret manager (1Password, AWS Secrets Manager, HashiCorp Vault, Doppler) when credentials must be shared across machines or services.
  • Treat every client-reachable config value as public — Firebase Remote Config, LaunchDarkly / feature flags, a /config endpoint, and any build-time env baked into a shipped bundle. Put no secret there; a client may only ever hold public identifiers.

NEVER

  • Commit files matching: *.pem, *.key, *.p12, *.pfx, .env, .env.local, *credentials*, id_rsa, id_dsa, id_ecdsa, id_ed25519.
  • Hardcode API keys, tokens, passwords, or connection strings in source code.
  • Include real secrets in test fixtures — use documented placeholders such as AKIAIOSFODNN7EXAMPLE, wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY, or xoxb-EXAMPLE-EXAMPLE.
  • Log or print secret values, even in debug mode.
  • Echo secrets to terminals in CI logs (mask via ::add-mask:: in GitHub Actions).
  • Embed signing keys in container images, even base images.
  • Distribute a bearer secret (webhook URL, API key, signing key) to clients at runtime via a config / feature-flag service (Remote Config, LaunchDarkly, a /config response). Anyone holding the app's public config can fetch it — it is as exposed as a hardcoded secret. Keep it server-side and proxy the privileged call through an authenticated backend that validates and rate-limits the request.

KNOWN FALSE POSITIVES

  • AWS documentation example: AKIAIOSFODNN7EXAMPLE and the matching secret access key wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY.
  • Strings containing: "example", "test", "placeholder", "dummy", "sample", "changeme", "your-key-here", "REPLACE_ME", "TODO", "FIXME", "XXX".
  • Hash literals in CSS/SCSS (e.g., #ff0000, #deadbeef).
  • Base64-encoded non-secret content in tests (lorem ipsum encoded, image fixtures).
  • Git commit SHAs in changelogs and release notes.
  • JWT tokens in the OAuth RFC documentation examples (eyJ... strings appearing in comments).

What ships with it: 1 file

931 B alongside SKILL.md

Keep looking

Skills are one crate of 327,069. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.