What is detecting-secrets?

A secret-detection guide for finding hardcoded API keys, tokens, passwords, and private credentials in files and Git history.

Use it to scan source and configuration files, inspect past commits, classify suspected secrets, and identify credentials that need to be revoked.

It helps catch credentials that may have been accidentally committed or exposed before code is published.

detecting-secrets — Skill for Claude Code by qte77/claude-code-plugins

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add qte77/claude-code-plugins --skill detecting-secrets

Clone the repo

git clone --depth 1 https://github.com/qte77/claude-code-plugins

Made for: Claude Code.

Or install security-audit, the plugin that ships this one along with the rest of its 4 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/qte77/claude-code-plugins/detecting-secrets/github.svg)](https://agentmods.dev/skills/qte77/claude-code-plugins/detecting-secrets)

Your own site

<a href="https://agentmods.dev/skills/qte77/claude-code-plugins/detecting-secrets"><img src="https://agentmods.dev/badge/skills/qte77/claude-code-plugins/detecting-secrets/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/qte77/claude-code-plugins/detecting-secrets"><img src="https://agentmods.dev/badge/skills/qte77/claude-code-plugins/detecting-secrets.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 34 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,141 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00034	$0.01141
Opus 5.5	$0.00014	$0.00456
Sonnet 5.5	$0.00007	$0.00228
Haiku 4.5	$0.00003	$0.00114

Measured 20d ago against content hash a2c604387bcf, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade B, and why

detecting-secrets scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 20d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Reaches for credential filesmediumPrivilege escalation

SSH keys, cloud credentials, git-credentials, .npmrc, /etc/shadow: reading these is how a config file becomes a credential leak.

- [ ] `.netrc` / `.pgpass` / `.my.cnf` with credentials

Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.

plugins/security-audit/skills/detecting-secrets/SKILL.md · 116 lines

How it starts

The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Secrets and Credential Detection

Scope: $ARGUMENTS

When to Use

Pre-publish audit (open-sourcing, npm publish, Docker push)
Reviewing PRs for accidental credential commits
Periodic security sweep
Post-incident secret rotation verification

Workflow

Scan files for secret patterns (see detection rules)
Check configuration files (.env, config, YAML, JSON)
Inspect git history for previously committed secrets
Classify findings by type and severity
Recommend remediation (rotate, revoke, remove)

Detection Patterns

API Keys and Tokens

AWS access keys (AKIA[0-9A-Z]{16})
AWS secret keys ([0-9a-zA-Z/+]{40} near AWS context)
GCP service account keys (JSON with "type": "service_account")
GCP API keys (AIza[0-9A-Za-z_-]{35})
Azure connection strings (DefaultEndpointsProtocol=)
GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
GitLab tokens (glpat-)
Slack tokens (xoxb-, xoxp-, xoxs-)
Stripe keys (sk_live_, pk_live_, rk_live_)
Generic API key patterns (api[_-]?key, apikey, api[_-]?secret)

Private Keys

RSA private keys (-----BEGIN RSA PRIVATE KEY-----)
EC private keys (-----BEGIN EC PRIVATE KEY-----)
OpenSSH private keys (-----BEGIN OPENSSH PRIVATE KEY-----)
PGP private keys (-----BEGIN PGP PRIVATE KEY BLOCK-----)
PKCS8 keys (-----BEGIN PRIVATE KEY-----)

Passwords and Credentials

Hardcoded passwords (password\s*=\s*["'][^"']+["'])
Database connection strings with credentials (://user:pass@)
JDBC URLs with passwords
.env files with secrets committed to repo
.netrc / .pgpass / .my.cnf with credentials

JWT and Session Secrets

JWT signing secrets in code (jwt.sign, JWT_SECRET)
Session secrets (SESSION_SECRET, SECRET_KEY)
Cookie signing keys
Encryption keys in plaintext

High-Risk File Patterns

Read the full file on GitHub · 116 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

20d ago Changed · +1 lines a2c604387bcf
1mo ago First seen · 115 lines · 34 tokens per session scan B fee0dd2f600e

Subscribe to this mod's changes

detecting-secrets is a skill published in the GitHub repository qte77/claude-code-plugins (3 stars, last pushed 3d ago), licensed Apache-2.0. It adds 34 tokens to every session and 1,141 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it B with 1 finding (reaches for credential files). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Claude Code Commits Git and workflow Security agent-skills ai-coding-tools claude-code-marketplace claude-code-plugins claude-code-skills

feature-flow

Complete git workflow orchestration (GitHub/GitLab/Forgejo) - branch, issue, commit.

sgaunet/claude-plugins · 24 tokens

workflow

Run the complete 5-step development workflow: focus problem → prevent over-development → test-first (TDD) → document → smart commit. Use when starting a new feature, or when the user runs /workflow or asks for the full development flow.

claude-world/director-mode-lite · 52 tokens

smart-commit

Create clean Conventional Commits: inspect the diff, group related changes, run quality checks, and write type(scope) messages. Use when committing work, or when the user runs /smart-commit or asks to commit changes.

claude-world/director-mode-lite · 49 tokens

commit

Create conventional commit from staged changes with approval.

sgaunet/claude-plugins · 10 tokens

commit-message

Use ANY time the user signals they want to commit staged changes — including bare "commit", "/commit", "commit this", "commit these changes", "let's commit", "make a commit", "git commit", "write a commit message", "make a conventional commit", "use conventional commits", or any equivalent phrasing in context (e.g.…

netopsengineer/axiom · 218 tokens

workflow-commit

Commit changes the way a sandboxed agent must — write Conventional Commit messages and, because commit signing fails inside the sandbox, hand the real commit off through a generated commit.sh script. Inside a git worktree, commit normally (unsigned) and emit a commit.sh that re-signs the range; in the main checkout…

bitwise-media-group/skills · 169 tokens

detecting-secrets