sast-hardcodedsecrets

Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/hardcodedsecrets-results.md. Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

77%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced security workflow with explicit checkpoints and concrete patterns. Its weaknesses are token efficiency from repeated framework/false-positive lists across the body and subagent prompts, and a lack of progressive disclosure for a skill of this length.

Suggestions

De-duplicate the frontend/backend and false-positive lists: define them once in the body and have the Phase 1 and Phase 2 subagent prompts reference that single source (or pass the relevant excerpt) instead of restating each list verbatim.

Extract the large secret-pattern reference table and/or the full subagent prompt templates into a bundled reference file (e.g. references/secret-patterns.md) linked from SKILL.md, so the main file stays a lean overview with one-level-deep navigation.

Tighten the opening "What Are Hardcoded Secrets" prose to assume Claude's existing knowledge of what a hardcoded secret is, leading directly into the public-accessibility distinction that is the skill's actual focus.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and concrete, but the framework public/not-public lists recur three times ("What to Report"/"What NOT to Report", "Distinguishing Frontend from Backend", and again inside the Phase 2 subagent prompt), and the false-positive/placeholder lists are likewise repeated across the body and both subagent prompts. The opening also restates what hardcoded secrets are.	2 / 3
Actionability	Provides concrete, copy-paste-ready guidance: exact regex patterns per secret type, named variable patterns, fully specified subagent prompts, and precise output-file templates with field-by-field formats.	3 / 3
Workflow Clarity	The three phases are clearly sequenced with an explicit validation gate ("If the recon found zero candidates... skip Phase 2 and Phase 3"), a detailed parallel batching procedure, ordered cleanup of intermediate files only after the final report is written, and a closing "Important Reminders" checklist.	3 / 3
Progressive Disclosure	Well-organized into sections, but the skill is a ~395-line monolith with no bundle files of its own; the large inline secret-pattern table and the full Phase 1/Phase 2 subagent prompt templates are content that could be split into one-level-deep reference files rather than carried inline.	2 / 3
	Total	10 / 12 Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that states concrete capabilities, an explicit trigger clause, prerequisites, and outputs, scoped to a distinct niche. It is concise yet complete.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions — "recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results)" — plus the concrete detection target and output path.	3 / 3
Completeness	Explicitly answers both what (detect hardcoded sensitive data via three phases, with prerequisite and output file) and when ("Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials").	3 / 3
Trigger Term Quality	Closes with natural user phrasing — "Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials" — covering the terms a user would actually say.	3 / 3
Distinctiveness Conflict Risk	Narrows to "publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates" and depends on sast/architecture.md, a clear niche distinct from general SAST that is unlikely to trigger for the wrong skill.	3 / 3
	Total	12 / 12 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: utkusen/sast-skills
Path: sast-files/.agents/skills/sast-hardcodedsecrets/SKILL.md
Commit: db52227

Reviewed: about 20 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.