Setup & Installation
openclaw skills install @aronchick/expanso-secrets-scan
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
npx clawhub install expanso-secrets-scan
What This Skill Does
Scans text or code for hardcoded secrets such as API keys, tokens, and passwords. Runs locally via the Expanso Edge binary as a CLI pipeline or MCP server. Can also be deployed to Expanso Cloud for remote execution.
Runs the scan locally through a lightweight binary without sending code to a third-party SaaS service.
When to use it
- Auditing a repository before making it public
- Checking a config file for accidentally included credentials
- Scanning a code snippet received from a colleague
- Reviewing environment files before committing to version control
- Verifying a script does not contain hardcoded tokens
Example Workflow
Here's how your AI assistant might use this skill in practice.
INPUT
User asks: Check this script for any hardcoded API keys or passwords
AGENT
- 1Receives the script content as input
- 2Pipes the content through the Expanso Edge secrets-scan CLI pipeline
- 3Parses the pipeline output for detected secrets
- 4Identifies the type and position of each finding
OUTPUT
A list of detected secrets with their types and locations in the input
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.
Expanso Edge binary installed in PATH (`clawhub install expanso-edge`)