agentsclimarketplace

Secret preflight

Skill Starr-del/ShipSafe/skills/secret-preflight

Offline deploy-safety skills for Claude Code. Zero credentials, zero network, zero dependencies.

Install
npx -y skills add Starr-del/ShipSafe --skill secret-preflight

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Scan a repository for committed secrets, API keys, tokens, and private keys before deploying or pushing. Use before any first push to a public repo, before any deploy, when the user mentions 'did I commit a secret', 'API key in code', security review, or open-sourcing a project — and proactively if you notice a hardcoded credential while doing other work. Runs fully offline — no API keys, no network, no credentials.

SKILL.md

1.9 KB, as published. Nobody here has run it

secret-preflight

Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.

python3 scripts/scan_secrets.py <project_root> [--json]

Two detection layers:

  1. High-precision patterns for real key formats: AWS, GitHub, Stripe (live vs test severity), OpenAI, Anthropic, Slack, Google, Supabase, private-key blocks, hardcoded JWTs, Postgres URLs with embedded passwords. JWTs are decoded offline: a payload with "role":"service_role" is escalated to a dedicated Supabase SERVICE_ROLE finding — that key bypasses Row Level Security entirely, so anywhere near client code it means the whole database is public. This single mistake is behind the largest documented vibe-coding breaches.
  2. Entropy analysis on assignments to secret-named variables (SECRET/TOKEN/API_KEY/...), with placeholder filtering to avoid false positives on 'your-api-key-here'.

Also verifies .gitignore actually covers .env files. Local .env contents are intentionally NOT flagged — that's where secrets belong; committed code is what's scanned.

Critical follow-ups when something is found:

  • If the key was EVER committed, removing the line is not enough — it lives in git history. The key must be ROTATED. Say this explicitly.
  • A finding can be suppressed for a known-safe line by adding the comment secret-preflight: allow.

Exit codes: 0 clean, 1 findings.

All paths below are relative to this skill's directory (secret-preflight/).

Keep looking

Skills are one crate of 328,083. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.