What is secrets-config-auditor?

A security review procedure for .NET projects that searches source code and configuration for hardcoded passwords, API keys, tokens, connection strings, and unsafe settings.

Auditing C# and configuration files, checking appsettings and deployment files, identifying sensitive-data logging, and recommending user-secret or vault-based storage.

It helps find credentials that could be exposed in code, committed files, logs, pipelines, or Docker images.

secrets-config-auditor — Skill for Claude Code by StefanTheCode

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add StefanTheCode/dotnet-ai-toolkit --skill secrets-config-auditor

Clone the repo

git clone --depth 1 https://github.com/StefanTheCode/dotnet-ai-toolkit

Made for: Claude Code.

Or install dotnet-ai-toolkit, the plugin that ships this one along with the rest of its 49 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/stefanthecode/dotnet-ai-toolkit/secrets-config-auditor/github.svg)](https://agentmods.dev/skills/stefanthecode/dotnet-ai-toolkit/secrets-config-auditor)

Your own site

<a href="https://agentmods.dev/skills/stefanthecode/dotnet-ai-toolkit/secrets-config-auditor"><img src="https://agentmods.dev/badge/skills/stefanthecode/dotnet-ai-toolkit/secrets-config-auditor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/stefanthecode/dotnet-ai-toolkit/secrets-config-auditor"><img src="https://agentmods.dev/badge/skills/stefanthecode/dotnet-ai-toolkit/secrets-config-auditor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 109 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 664 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00109	$0.00664
Opus 5.5	$0.00044	$0.00266
Sonnet 5.5	$0.00022	$0.00133
Haiku 4.5	$0.00011	$0.00066

Measured 2mo ago against content hash f88859d02429, method: parsed. Prices are Anthropic first-party input rates as of 2026-10-07, from the pricing page.

Security

Grade A, and why

secrets-config-auditor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2mo ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/secrets-config-auditor/SKILL.md · 42 lines

How it starts

The opening of the file, as written. The whole thing — 42 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Secrets & Config Auditor

Find credentials and secrets that shouldn't be in source or committed config, and move them to a proper secret store.

Input — point it at your project / repo

Works on a target: a project, repo, or GitHub URL. Scan source, config, and (if a repo) committed history hints:

grep -rniE "password\s*=|pwd=|apikey|api_key|secret|connectionstring|bearer |token\s*=|AccessKey|PrivateKey" \
  --include=*.cs --include=*.json --include=*.config --include=*.yml <target> | grep -vi "/obj/\|/bin/"
grep -rn "EnableSensitiveDataLogging\|//.*password\|placeholder" <target>

Check appsettings*.json, .env, launchSettings.json, pipeline YAML, and .csproj.

What it flags

🔴 Hardcoded secrets in source — keys/passwords/tokens in .cs.
🔴 Secrets in committed appsettings.json — connection strings with passwords, API keys. (Dev secrets belong in user-secrets, prod in a vault.)
🔴 Secrets in pipeline YAML / Dockerfiles — should be pipeline secret variables.
🟡 EnableSensitiveDataLogging() unconditional — leaks parameter values to logs.
🟡 Weak config hygiene — secrets in launchSettings.json, .env committed, no .gitignore coverage.

Fix recommendations

Dev: dotnet user-secrets (per-project, outside the repo).
Prod: Azure Key Vault / AWS Secrets Manager / HashiCorp Vault, surfaced via configuration providers or env vars.
CI: pipeline secret variables, never in YAML literals.
Rotate anything that was committed — it's compromised even after removal (git history).
Add patterns to .gitignore; consider a pre-commit secret scanner (gitleaks).

Principles

A secret in source/committed config is a leaked secret — and history keeps it. Rotate, don't just delete.
Config should reference secrets, not contain them.
Different environments, different stores — never one committed file with prod creds.

How to use it & best prompts

"Do I have any hardcoded secrets", "scan my repo for leaked credentials", "is my appsettings safe to commit", "where should these connection strings live". Pairs with the aspnetcore-security-auditor agent.

Read the full file on GitHub · 42 lines

Files

What ships with it

1 file beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

USAGE.md 916 B

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

2mo ago First seen · 42 lines · 109 tokens per session scan A f88859d02429

Subscribe to this mod's changes

secrets-config-auditor is a skill published in the GitHub repository StefanTheCode/dotnet-ai-toolkit (26 stars, last pushed 2mo ago), licensed MIT. It adds 109 tokens to every session and 664 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.