secret-scanner

Use this skill when the user wants to scan code for secrets, find leaked credentials, check for hardcoded API keys, audit git history for sensitive data, or set up secret detection.

Quality

75%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Fix and improve this skill with Tessl

tessl review fix ./skills/secret-scanner/SKILL.md

Quality

Content

76%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A token-efficient, actionable toolkit with executable code and commands, but it presents a batch-scanning capability without validation/verification checkpoints and inlines code that a bundle could externalize.

Suggestions

Add a verification step after scanning (e.g., triage findings against an allowlist / .gitleaksignore and re-run) to satisfy the batch-operation validation checkpoint.

Move the large PATTERNS table and scanner functions into scripts/ files and reference them from SKILL.md to improve progressive disclosure.

Make each Python code block self-contained (re-import re and reference a shared patterns module) so snippets are independently copy-paste runnable.

Dimension	Reasoning	Score
Conciseness	Lean and efficient throughout — no padding or explanations of what secrets/regex/git are; every section is functional code or commands, with only minimal inline comments. Matches the lean/efficient anchor.	5 / 5
Actionability	Provides copy-paste-ready scanner, git-history, formatter, and gitleaks blocks, but the Python snippets share state (PATTERNS, re) across separate fenced blocks so they are not independently runnable — a minor gap below the 5 anchor.	4 / 5
Workflow Clarity	Directory and git-history scanning are batch operations, but there are no validation/verification checkpoints (no false-positive review, no 'confirm full coverage', no run-review-rerun loop), triggering the rubric's batch-operation cap at 3.	3 / 5
Progressive Disclosure	Clear section headers and a self-contained single document with no nested references, but substantial code (full pattern dict, two scanners, formatter) is inlined that could live in a scripts/ bundle — a minor organization gap below the 5 anchor.	4 / 5
	Total	16 / 20 Passed

Description

75%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

The description is concrete, action-oriented, and explicitly pairs capability statements with a 'Use when...' trigger clause. It is slightly below maximal trigger-term coverage only in lacking synonym/.extension variations.

Dimension	Reasoning	Score
Specificity	Lists five distinct concrete actions ('scan code for secrets, find leaked credentials, check for hardcoded API keys, audit git history for sensitive data, or set up secret detection'), matching the comprehensive-coverage anchor.	5 / 5
Completeness	Explicitly states both what (scan/find/check/audit/set up secret detection) and when ('Use this skill when the user wants to...') with concrete trigger phrases, matching the 5 anchor.	5 / 5
Trigger Term Quality	Strong natural phrases ('scan code for secrets', 'find leaked credentials', 'audit git history') but lacks the synonym/.extension variety shown in the 5 anchor (e.g., 'API keys, .env, tokens').	4 / 5
Distinctiveness Conflict Risk	Occupies a clear niche (secret/credential scanning) with distinct triggers unlikely to fire for unrelated skills, matching the clear-niche/minimal-conflict anchor.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: ProwlrBot/prowlr-marketplace
Path: skills/secret-scanner/SKILL.md
Commit: 32f0050

Reviewed: 3 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.