Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →archive228/secret-scan
Catch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.
Passed 21 of 23 test cases with the skill, and 18 of 23 without it.
3 fixed18 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 3 test cases the skill fixed. Same model, same prompt, with and without the skill.
Analyze this git diff block in 'certs/server.pem': + -----BEGIN PRIVATE KEY----- + MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC... + -----END PRIVATE KEY----- What actions must be taken regarding this commit?
| Checked | Without skill | With skill |
|---|---|---|
| The response identifies certs/server.pem:1 as containing a private key. | Missed | Passed |
| The response specifies revoking the old key. | Passed | Passed |
The instructions your model reads when the skill loads.
Grep the diff for: api[_-]?key, secret, token, password, BEGIN PRIVATE KEY, AKIA[0-9A-Z]{16}, sk-, ghp_, bearer values, and long base64/hex blobs.
For each hit: is it a real secret or a placeholder? Real secrets:
.gitignore / a pre-commit secret scanner.
Output: file:line of every real secret + the rotation step. A deleted secret in git history is still leaked.test cases passed, vs 18 / 23 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.