Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Scans codebases, config files, and directories for accidentally exposed secrets. Detects 40+ patterns covering API keys, tokens, passwords, connection strings, and private keys across major cloud providers and developer services. Outputs findings as a Markdown report or JSON with severity ratings and remediation steps.
Requires no external dependencies beyond Python, so it runs immediately without package installs or API accounts, unlike tools such as truffleHog or gitleaks.
When to use it
- Auditing a repo before pushing to GitHub
- Checking if AWS credentials were hardcoded in a config file
- Running a pre-commit scan to catch leaked Stripe live keys
- Finding hardcoded database passwords across environment files
- Reviewing a forked project for exposed credentials before using it
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Scan my project directory for leaked secrets before I publish
- 1Run secret_scanner.py on the project directory recursively
- 2Match file contents against 40+ secret patterns for cloud keys, tokens, and passwords
- 3Assign severity ratings (Critical, High, Medium, Low) to each finding
- 4Generate a Markdown report listing each secret by type, file, and location
- 5Provide remediation steps for rotating and removing each exposed credential
Markdown report with 3 findings: a hardcoded AWS Access Key (Critical), a Stripe test key (Medium), and a generic password= in a config file (Low), each with rotation and removal guidance