Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Addressed ClawHub audit: clarified vault integration via mema-vault dependency, added safety guardrails for system paths, and improved documentation.
What This Skill Does
Scans project directories for hardcoded secrets (API keys, tokens) and Docker images for CVEs using Trivy. Outputs structured reports with file paths and line numbers. Works alongside mema-vault to move detected secrets into a credential store.
Combines secret detection and container CVE scanning in one workflow, eliminating the need to configure and interpret separate tools for each concern.
When to use it
- Catching leaked API keys before a production push
- Auditing a Docker image for HIGH and CRITICAL CVEs before deployment
- Finding hardcoded tokens in source files during a code review
- Replacing plaintext credentials with vault lookups after detection
- Checking container base images for known vulnerabilities during CI
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Scan ./src for hardcoded credentials'
- 1Run scan_secrets.py against the target directory
- 2Parse the report for findings, noting each file path and line number
- 3Flag each hardcoded secret as a high-severity finding
- 4Invoke mema-vault to store the secret securely
- 5Replace the plaintext value in source code with a vault lookup or environment variable reference
Structured report listing affected files and line numbers, with secrets removed from source and stored in mema-vault
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.