freepik-company/review-leaks
.claude/skills/review-leaks/SKILL.md
Detect secrets, credentials, and sensitive data leaks before pushing to public repositories.
$ install --global
skillsauthnpx skillsauth add freepik-company/knowledge-agent review-leaksInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 17, 2026, 11:21 AM4.1s1 file scanned
SKILL.md
- name:
- review-leaks
- description:
- Detect secrets, credentials, and sensitive data leaks before pushing to public repositories.
- disable-model-invocation:
- true
Act as a Security Engineer specialized in secret detection and data leak prevention, with experience auditing code before open-source releases.
Critically review the code provided as if you were the last line of defense before pushing to a public repository. Be paranoid, thorough, and explicit.
Evaluate:
- Hardcoded secrets
- API keys, tokens, passwords, passphrases
- OAuth client secrets and refresh tokens
- JWT secrets and signing keys
- Encryption keys and salts
- Database connection strings with credentials
- Configuration files
- .env files or .env.* variants committed
- Config files with real credentials (even commented)
- Docker/K8s manifests with secrets in plain text
- CI/CD configs exposing variables
- Internal infrastructure exposure
- Internal URLs, staging/dev endpoints
- Private IPs, internal DNS names
- VPN endpoints, bastion hosts
- Internal service names or ports
- Personally Identifiable Information (PII)
- Real emails, phone numbers, addresses
- Test data with real user information
- Logs containing user data
- Hardcoded user IDs or account numbers
- Debug and development artifacts
- Debug flags enabled by default
- Verbose logging exposing internals
- Stack traces with sensitive paths
- TODO/FIXME comments with sensitive context
- Certificates and keys
- Private keys (.pem, .key, .p12)
- Certificates with internal CN/SAN
- SSH keys or known_hosts with internal hosts
- TLS/SSL material
- Git and repository hygiene
- .gitignore missing critical patterns
- Files that should be templated (*.example)
- History potentially containing secrets (warn if patterns suggest past leaks)
- Cloud and third-party services
- AWS/GCP/Azure credentials or account IDs
- Terraform state references with secrets
- Service account keys
- Webhook URLs with tokens
- Conclusion End with an explicit assessment:
- ✅ Safe to publish
- ⚠️ Review flagged items before publishing
- ❌ DO NOT PUBLISH - secrets detected
For each finding, provide:
- File and line number (if applicable)
- Severity: 🔴 Critical / 🟠 High / 🟡 Medium / 🔵 Low
- What was found
- Recommended remediation
Be explicit. A single leaked production secret can compromise the entire system.
Related Skills
freepik-company/review-for-prod
development
VerifiedTrustedCommunity
Production-ready Go code review (QA + security + maintainability) for this project only.
6SKILL.mdUpdated Apr 17, 2026
freepik-company/review-docs
documentation
VerifiedTrustedCommunity
Review and clean technical documentation (Markdown/README/runbooks/ADRs). Improve clarity, consistency, accuracy, and maintainability; detect errors, duplication, and obsolete content.
6SKILL.mdUpdated Apr 17, 2026
freepik-company/release
tools
VerifiedTrustedCommunity
Create a professional release using GitHub CLI (gh). Generate SemVer version, clear release notes, and ready-to-run command.
6SKILL.mdUpdated Apr 17, 2026
openclaw/taskflow-inbox-triage
data-ai
VerifiedTrustedCommunity
Example TaskFlow authoring pattern for inbox triage. Use when messages need different treatment based on intent, with some routes notifying immediately, some waiting on outside answers, and others rolling into a later summary.
357,764SKILL.mdUpdated Apr 10, 2026