Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Quality-Max/free-qa-skills --skill secret-scangit clone --depth 1 https://github.com/Quality-Max/free-qa-skillsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/quality-max/free-qa-skills/secret-scan)<a href="https://agentmods.dev/skills/quality-max/free-qa-skills/secret-scan"><img src="https://agentmods.dev/badge/skills/quality-max/free-qa-skills/secret-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/quality-max/free-qa-skills/secret-scan"><img src="https://agentmods.dev/badge/skills/quality-max/free-qa-skills/secret-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00050 | $0.00984 |
| Opus 5.5 | $0.00020 | $0.00394 |
| Sonnet 5.5 | $0.00010 | $0.00197 |
| Haiku 4.5 | $0.00005 | $0.00098 |
Grade A, and why
secret-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 79 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Secret Scan
Catch a leaked credential before it lands in git history. No signup required.
Prerequisites
- None. Pure Claude Code — works in any repo, no MCP required.
Trigger
- "Scan for hardcoded secrets"
- "Any leaked keys in my changes?"
- "Secret scan before I commit"
Workflow
- Choose scope:
- Pre-commit (default): enumerate staged, unstaged, and untracked file names separately without printing their contents. Treat the staged index and working tree as distinct sources: a path can contain different content in each.
- Full tree: scan tracked files (skip
.git,node_modules, lockfiles,dist/, binaries).
- Scan each source with a local tool that redacts every match before it reaches command output or agent context:
- For staged paths, scan the index blob directly rather than the on-disk file. Do not substitute the working-tree version: content removed locally can still remain staged for commit.
- For unstaged and untracked paths, scan the on-disk file independently. Do not print either version while comparing them.
- Never run a raw diff, search, index-blob read, or file read that prints matching values. Report only the source (
indexorworking tree),file:line, the secret type, and at most the first 4 non-sensitive identifying characters. If the scanner cannot read and redact a source safely, mark that source as not assessed instead of exposing candidate values.
Patterns
| Provider / type | Signature |
|---|---|
| AWS access key | AKIA[0-9A-Z]{16} |
| AWS secret key | 40-char base64 near aws_secret |
| Google API key | AIza[0-9A-Za-z\-_]{35} |
| GitHub token | ghp_, gho_, ghs_, github_pat_ |
| Slack token | xox[baprs]- |
| Stripe | sk_live_, rk_live_ |
| OpenAI / Anthropic | sk-, sk-ant- |
| Private key block | `-----BEGIN (RSA |
| JWT | eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\. |
| Connection string | `(postgres |
| Generic assignment | `(password |
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago Changed · +9 lines ec6c88cf7303
- 1mo ago First seen · 70 lines · 50 tokens per session scan A 0c5ef9c6faff
secret-scan is a skill published in the GitHub repository Quality-Max/free-qa-skills (13 stars, last pushed yesterday), licensed Apache-2.0. It adds 50 tokens to every session and 984 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
developer_pr_prep
Prepare branches, diffs, tests, and GitHub PR text from a conversation's code folder.
pr-review
Review pull requests: diffs, comments, context and written review docs.
best-practices
Apply modern web development best practices for security, compatibility, and code quality. Use when asked to "apply best practices", "security audit", "modernize code", "code quality review", or "check for vulnerabilities".
engineering-standards
Team engineering practice — code conventions and readability, git and branching workflow, commit and pull request hygiene, code review standards, architecture decision records, documentation and runbooks, onboarding, developer experience, and managing technical debt deliberately. Use when the user says "code review"…
release-readiness
The go/no-go gate before shipping — a structured launch checklist across security, data, legal, operations, performance, accessibility and rollback, producing an explicit ship or do-not-ship decision with named blockers. Use when the user says "ready to launch", "go live", "ship it", "pre-launch", "launch checklist"…
ship
Pre-PR check orchestrator. Runs /critique with a threshold (default 80), /slop --severity high, gathers git context (branch, changed files), and optionally opens a PR via the gh CLI. Use before opening any PR. Exits non-zero if any check fails. Run as node /.claude/skills/dragoon/skills/ship/scripts/ship.js.