Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Scans files, directories, and repos for accidentally leaked secrets and credentials. Detects 40+ patterns including AWS keys, database connection strings, private keys, and tokens from major cloud and SaaS providers. Outputs findings as a Markdown report or JSON with severity ratings and remediation steps.
Covers 40+ provider-specific patterns in a single no-dependency Python script, avoiding the need to install and configure heavier tools like truffleHog or gitleaks.
When to use it
- Audit a repo before pushing to GitHub
- Check config files for hardcoded database passwords
- Find exposed API keys before open-sourcing a project
- Run a pre-commit security check on changed files
- Scan a cloned repo for credentials left by a previous developer
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: 'Scan this project for leaked secrets before I publish it'
- 1Run secret_scanner.py on the project directory
- 2Parse results grouped by severity level
- 3Identify critical findings such as AWS keys or private keys
- 4List each finding with file path, line number, and pattern matched
- 5Provide remediation steps for each detected secret
Markdown report listing 3 findings: one Critical (AWS Secret Key in .env), one High (GitHub PAT in config.yml), one Low (placeholder password= in README comment), each with rotation and removal guidance