Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add codebygarv/Ai-skills --skill secrets-scannergit clone --depth 1 https://github.com/codebygarv/Ai-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/codebygarv/ai-skills/secrets-scanner)<a href="https://agentmods.dev/skills/codebygarv/ai-skills/secrets-scanner"><img src="https://agentmods.dev/badge/skills/codebygarv/ai-skills/secrets-scanner.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00045 | $0.00602 |
| Opus 5 | $0.00023 | $0.00301 |
| Sonnet 5 | $0.00009 | $0.00120 |
| Haiku 4.5 | $0.00005 | $0.00060 |
Grade A, and why
secrets-scanner scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 5d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 35 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Find hardcoded secrets — API keys, passwords, tokens, private keys, connection strings with embedded credentials — sitting in code or config where they shouldn't be. Narrow and mechanical by design, unlike Security Auditor's broader vulnerability sweep.
When to Use
- Before committing/opening a PR, especially after copy-pasting example code or config from elsewhere.
- Auditing an existing codebase for accidentally-committed secrets, e.g. before making a private repo public.
- The user specifically asks to check for "hardcoded secrets," "leaked credentials," or similar.
What to Analyze
- Obvious credential patterns — variables/constants assigned literal strings that look like API keys, tokens, passwords, or private keys (common prefixes like
sk_,AKIA,ghp_, PEM-----BEGIN PRIVATE KEY-----blocks, etc.). - Connection strings with embedded credentials — database URLs, message queue URLs, etc. containing a username:password directly in the string.
- Config files —
.env-style files, YAML/JSON config, checked-in Docker/CI config, for values that should be pulled from a secrets manager or environment instead. - Comments and commented-out code — secrets left in comments or disabled code are just as exposed as live code.
- Test/example code — flag but treat with lower severity if it's obviously a placeholder (
sk_test_xxx,password123in a clearly-fake example) versus something that looks like a real, live credential.
Output Format
- Each finding: file/line, the type of secret suspected, a redacted version of the value (never repeat the full secret back in the output), and the fix (move to environment variable / secrets manager, add to
.gitignoreif it's a file). - Flag real-looking credentials as Critical and placeholder/test-looking ones as Low — don't treat them the same.
- If a secret appears to already be committed to git history (not just the current working tree), note explicitly that removing it from the current file isn't sufficient — it needs rotation (treat as compromised) and, ideally, history rewriting.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 5d ago First seen · 35 lines · 45 tokens per session scan A fbae7cd7b996
secrets-scanner is a skill published in the GitHub repository codebygarv/Ai-skills (25 stars, last pushed 19d ago), licensed MIT. It adds 45 tokens to every session and 602 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
git-commit
Conventional Commits format for git commits and PR/MR titles. Type prefixes, scope rules, breaking change syntax, and commit message structure. Use when committing changes, writing commit messages, creating PR/MR titles, or formatting squash merge messages. Not for PR workflows (git-pr), CI/CD status (git-ci), or git…
git-pr
PR and MR workflows for GitHub (gh) and GitLab (glab). Creation, review comment handling, thread resolution, review state queries, merging, cost-aware bot review rounds (GitHub: Copilot, CodeRabbit), and Copilot code review configuration (rulesets, custom instructions, billing). Use when creating PRs/MRs, addressing…
git-project
GitHub Projects (v2) setup and management via gh CLI + GraphQL: organize a repo's issues into epics with native sub-issues, drive a board Status flow (Todo -> In Progress -> Done), set Project Priority, classify with native issue Types (Task/Bug/Feature) instead of labels, scope work with milestones (incl. resolving…
ds-commit
Smart commits — quality gates, atomic grouping, Conventional Commits formatting. Use when committing changes, grouping a working tree into atomic commits, or writing commit messages.
git-workflow-guide
Git workflow reference covering branch naming, commit message conventions, PR templates, merge strategies, and common operations — for consistent team collaboration.
chinese-commit-conventions
A Chinese-language guide to Conventional Commits, a format for writing consistent Git commit messages, plus related changelog, commit-checking, and commit-helper configuration.