secrets-scan

Detect hardcoded credentials, API keys, tokens, and secrets in source code and configuration files. Use when reviewing code for leaked secrets before commit/merge, auditing a repository for credential exposure, or setting up secret detection.

Quality

83%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

78%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A concise, actionable scanning procedure with a clear sequenced workflow and built-in verification. Its main weakness is progressive disclosure: it points to procedure and template files that are not present in the bundle.

Suggestions

Add the missing bundle files referenced in the body (plays/secrets-scan.md and templates/finding.md), or remove the references and inline the necessary detail so the skill is self-contained.

Provide ready-to-run search commands for the manual-pattern step (e.g., grep -rE 'AKIA[0-9A-Z]{16}' .) instead of only naming the patterns, to lift actionability from 4 to 5.

Add an explicit error-recovery feedback loop for the automated-scanner step (e.g., 'if the scanner errors or returns no results, fall back to manual pattern analysis and re-run'), to push workflow_clarity toward 5.

Dimension	Reasoning	Score
Conciseness	Lean ~35-line body that assumes Claude's competence, lists only actionable commands and patterns with no concept explanations or padding; every token earns its place.	5 / 5
Actionability	Provides concrete, copy-paste-ready scanner commands with flags and a preference order, plus specific detection patterns; minor gap is that the manual-pattern step names patterns (AKIA..., sk-...) without supplying ready-to-run grep commands.	4 / 5
Workflow Clarity	Clear four-step sequence with an explicit verification checkpoint in Step 3 (Contextual Analysis: 'Is it real? Is it active?') and a preventive-controls checklist; no explicit error-recovery feedback loop for scanner failures beyond the fallback note.	4 / 5
Progressive Disclosure	Sections are well-organized and references are clearly signaled and one-level-deep ('plays/secrets-scan.md', 'templates/finding.md'), but neither referenced file exists in the bundle, breaking the disclosure chain the skill leans on.	3 / 5
	Total	16 / 20 Passed

Description

87%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, well-scoped description that clearly states what the skill does and when to use it with natural trigger phrases. Minor room to broaden action variety and add a few more concrete trigger terms.

Dimension	Reasoning	Score
Specificity	Names the domain and enumerates several concrete detection targets ('hardcoded credentials, API keys, tokens, and secrets in source code and configuration files'), but relies on a single action verb ('Detect') rather than multiple distinct actions, leaving minor coverage gaps.	4 / 5
Completeness	Explicitly answers both 'what' (detect hardcoded credentials, API keys, tokens, and secrets) and 'when' with a concrete 'Use when...' clause listing three trigger scenarios, matching the top anchor.	5 / 5
Trigger Term Quality	Strong natural trigger phrases and synonyms ('leaked secrets before commit/merge', 'credential exposure', 'secret detection') cover common user phrasings, but specific file-extension or scan-tool terms that users might say are absent.	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (secret/credential detection) with distinct triggers ('leaked secrets', 'credential exposure', 'secret detection') and minimal overlap risk with other skills.	5 / 5
	Total	18 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: OWASP/secure-agent-playbook
Path: plugins/code-security-skills/skills/secrets-scan/SKILL.md
Commit: 79fea6b

Reviewed: 4 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.