/security--secrets-scan

/security--secrets-scan is a Claude Code skill in the Code section. Scans your code, config files and recent git history for API keys, tokens, passwords and private keys, and explains how to remediate each.

Author's description

Scan codebase for leaked secrets, API keys, tokens, and credentials

How to ask for it

/security--secrets-scan scan the repo for leaked API keys
/security--secrets-scan check for exposed credentials before pushing to GitHub
/security--secrets-scan scan the whole project for forgotten tokens

Install

curl -fsSL https://raw.githubusercontent.com/sgomez-dev/claude-skills/main/install.sh | bash

After installing with the script, type /security--secrets-scan. Using Cursor, Windsurf or Codex? Platform guides

Demo coming soon

Pairs well with

/devops--deploy-checkPre-deployment checklist
Runs a checklist before you ship, covering code quality, security, database and configuration, to catch problems before release.
Built here
/security--dependency-vulnDependency vulnerability check
Runs your package manager's audit and lists each vulnerable dependency with its CVE, severity, fixed version and a remediation plan.
Built here
/performance--perf-auditPerformance audit
Audits your backend and frontend code for bottlenecks and lists each finding with its location, estimated impact and a specific fix.
Built here
/testing--test-coverageTest coverage gaps
Finds which code your tests don't cover, ranks the gaps by risk and generates tests for the highest-priority ones.
Built here
/security--security-auditOWASP security audit
Audits your codebase against the OWASP Top 10 and returns each finding with severity, file and line, a description and a fix.
Built here
/security--auth-reviewLogin and permissions review
Reviews your app's login, sessions, tokens and access rules and returns severity-rated findings, each with a specific fix.
Built here

Recipe: /pipeline--pre-deploy Pre-Deploy
Recipe: /pipeline--security-hardening Security Hardening

/security--threat-modelSTRIDE threat model
Analyzes your repo's architecture and writes threat-model.md with a data-flow diagram, rated STRIDE threats and a top-5 action list.
Built here
/testing--contract-testingContract tests between services
Sets up consumer-driven contract tests (Pact by default) so breakages between services are caught at build time without running both together.
Built here
/testing--load-testingLoad testing setup
Sets up load tests with k6, Locust or Artillery: realistic scenarios, pass/fail thresholds and a lightweight smoke gate in CI.
Built here
/testing--mutation-testingMutation testing setup
Sets up mutation testing to measure whether your tests would catch real bugs, then turns surviving mutants into stronger tests.
Built here
/testing--playwright-mcpBrowser automation with Playwright
Drives a real browser through Playwright MCP to navigate, click, fill forms, debug pages and take screenshots.
Built here
/testing--snapshot-updateTest snapshot updates
Reviews failing test snapshots and decides whether each is an intended change, a real bug or a flaky test before updating anything.
Built here

How to ask for it

Install

Pairs well with

More from this section