vibeeval/secret-scanner
skills/secret-scanner/SKILL.md
Pre-push API key and credential scanner - blocks git push if secrets found
$ install --global
skillsauthnpx skillsauth add vibeeval/vibecosystem secret-scannerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Jun 11, 2026, 5:41 AM151.8s1 file scanned
SKILL.md
- name:
- secret-scanner
- description:
- Pre-push API key and credential scanner - blocks git push if secrets found
- version:
- 1.0.0
- category:
- security
- tags:
- [secrets, api-keys, pre-push, git-hooks, security]
Secret Scanner
Scans your codebase for leaked API keys, tokens, and credentials. Blocks git push if secrets are found.
Usage
# Scan current directory
vibeco secrets
# Scan specific path
vibeco secrets /path/to/project
Detected Secrets (22 patterns)
| Provider | Pattern | Example |
|----------|---------|---------|
| OpenAI | sk-proj-..., sk-... | sk-proj-abc123... |
| Anthropic | sk-ant-... | sk-ant-api03-... |
| AWS | AKIA... | AKIAIOSFODNN7EXAMPLE |
| GitHub | ghp_..., gho_..., github_pat_... | ghp_xxxxxxxxxxxx |
| Stripe | sk_live_..., pk_live_... | sk_live_4eC39H... |
| Google | AIza... | AIzaSyDaGm... |
| Slack | xoxb-..., xoxp-... | xoxb-123-456-abc |
| SendGrid | SG.... | SG.xxx.yyy |
| npm | npm_... | npm_xxxxxxxxxxxxx |
| PyPI | pypi-... | pypi-AgEIcHl... |
| Database URLs | postgres://, mongodb://, mysql://, redis:// | With embedded passwords |
| Private Keys | PRIVATE KEY----- | PEM format |
Auto-Setup: Git Pre-Push Hook
Add to your project's .git/hooks/pre-push:
#!/bin/bash
vibeco secrets "$(git rev-parse --show-toplevel)" || exit 1
Make it executable:
chmod +x .git/hooks/pre-push
Now every git push will scan for secrets first. If any are found, push is blocked.
How It Works
- Walks all source files (skips node_modules, dist, .git, lock files)
- Matches 22 regex patterns for known API key formats
- Skips comments and regex definition lines (avoids false positives)
- If secrets found: prints masked values, exits with code 1 (blocks push)
- If clean: prints success, exits with code 0
What to Do If Secrets Are Found
- Remove the secret from source code
- Move to
.envfile (add.envto.gitignore) - Use environment variables:
process.env.API_KEY - If already pushed: rotate the credential immediately (it's compromised)
Scanned File Types
.ts .tsx .js .jsx .mjs .cjs .py .go .java .rb .php .rs .swift .kt .json .yml .yaml .toml .env .cfg .conf .ini .sh .bash .zsh .xml .properties .gradle
Related Skills
vibeeval/workflow-router
development
VerifiedTrustedCommunity
Goal-based workflow orchestration - routes tasks to specialist agents based on user goals
500SKILL.mdUpdated Jun 11, 2026
vibeeval/wiring
tools
VerifiedTrustedCommunity
Wiring Verification
500SKILL.mdUpdated Jun 11, 2026
vibeeval/websocket-patterns
development
VerifiedTrustedCommunity
Connection management, room patterns, reconnection strategies, message buffering, and binary protocol design.
500SKILL.mdUpdated Jun 11, 2026
vibeeval/vp-engineering
testing
VerifiedTrustedCommunity
VP Engineering perspective - org design (team topologies), process improvement, cross-team dependencies, engineering culture, OKRs, incident management maturity, platform strategy, DX optimization, release management at scale
500SKILL.mdUpdated Jun 11, 2026