Scan Secrets
Scan for exposed secrets and credentials in codebase
- Type
- Slash Command
- Repository
- jeremylongshore/tons-of-skills-marketplace
- GitHub stars
- 2.8k
- License
- MIT
- Repo last updated
- Sep 27, 2026
What Scan Secrets is
Scan Secrets is a slash command published in the jeremylongshore/tons-of-skills-marketplace repository on GitHub, which has about 2.8k stars. The repository describes itself as: “Model-agnostic agent-skills platform with a harness-free canonical layer, verified adapters, and the ccpi package manager. Explore at tonsofskills.com.”
A slash command is a reusable prompt saved as a markdown file and run by typing its name after a slash. In Claude Code, custom commands have been merged into skills: a file in .claude/commands/ and a skill folder in .claude/skills/ both create the same kind of command, and existing command files keep working.
Scan Secrets gives you a repeatable way to run the same instructions without retyping them, optionally with arguments.
How to install Scan Secrets
Claude Code
- Download scan-secrets.md from the repository.
- Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md.
- Run it by typing / followed by its name.
Claude Cowork
- Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it.
- In Customize → Skills, click +, then upload the ZIP.
- Run it from any task with / and the skill name.
New to extending Cowork? Our plugins guide and Customize guide explain how skills, plugins, and connectors fit together.
Inside the source file
An excerpt from plugins/security/secret-scanner/commands/scan-secrets.md, shared under the repository's MIT license. Read the full file on GitHub.
Scan codebase for exposed secrets, API keys, passwords, tokens, and sensitive credentials that should not be committed to version control.
Detection Methods
- Pattern Matching
- API keys (AWS, Google, Azure, Stripe, etc.)
- Private keys (RSA, SSH, PGP)
- Database credentials
- OAuth tokens
- JWT tokens
- Passwords in configuration files
- Entropy Analysis
- High-entropy strings (base64, hex)
- Random-looking strings that may be secrets
- Cryptographic keys
- Common Mistakes
- Hardcoded credentials in source code
- Credentials in commit history
- Secrets in configuration files
- Environment variables committed to repo
- Backup files containing secrets
- File Type Analysis
- .env files
- Configuration files
- Shell scripts
- Docker files
- CI/CD configuration
Report Output
Generate detailed secret exposure report with:
- Location of each secret (file, line number)
- Type of secret detected
- Severity level (Critical, High, Medium)
- Remediation steps
- Git history scan results
Immediate Actions
For exposed secrets:
- Rotate immediately - Revoke and regenerate
- Remove from git history - Use git-filter-branch or BFG
- Update .gitignore - Prevent future commits
- Use secret management - HashiCorp Vault, AWS Secrets Manager
- Enable pre-commit hooks - Prevent secret commits
Best Practices
- Never commit secrets to version control
- Use environment variables
- Use secret management tools
- Enable pre-commit secret scanning
- Rotate secrets regularly
- Audit git history periodically
Before you install
- Read the whole file first. Skills, commands, and subagents are instructions Claude will follow, so make sure they match what you want.
- Check which tools, scripts, or MCP servers it uses. Local servers and scripts run with your permissions.
- Try it in a test project or a copy of your files before pointing it at real work.
- Pin the version you tested, and review changes before updating.
- Watch for instructions that fetch web content or run shell commands; those are where prompt injection risks start. See our prompt injection guide.
FAQ
What is Scan Secrets?
Scan Secrets is a slash command for Claude Code and Claude Cowork from the jeremylongshore/tons-of-skills-marketplace repository on GitHub. Scan for exposed secrets and credentials in codebase
How do I install Scan Secrets in Claude Code?
Download scan-secrets.md from the repository. Save it to ~/.claude/commands/ (all projects) or .claude/commands/ (one project). As a skill, you can instead save it as ~/.claude/skills/<name>/SKILL.md. Run it by typing / followed by its name.
Can I use Scan Secrets in Claude Cowork?
Turn the command into a skill: create a folder with the file saved as SKILL.md and zip it. In Customize → Skills, click +, then upload the ZIP. Run it from any task with / and the skill name.
Is Scan Secrets safe to install?
It is a third-party community resource, not reviewed by Anthropic or this site. Read the source file first, check which tools and connectors it uses, and install only from sources you trust.
Similar resources
- Database Health Monitor Database plugin for database-health-monitor Plugin · jeremylongshore/tons-of-skills-marketplace
- Database Query Profiler Profile and optimize database queries for performance Plugin · jeremylongshore/tons-of-skills-marketplace
- Database Partition Manager Database plugin for database-partition-manager Plugin · jeremylongshore/tons-of-skills-marketplace
- Database Migration Manager Manage database migrations with version control, rollback capabilities, and automated schema evolution tracking Plugin · jeremylongshore/tons-of-skills-marketplace
- Secrets Integrate Integrate with secrets managers (Vault, AWS Secrets Manager, etc) Slash Command · jeremylongshore/tons-of-skills-marketplace
- Scan Movers Scan for top market movers across crypto, stocks, and forex with real-time Slash Command · jeremylongshore/tons-of-skills-marketplace
- Security Scan Comprehensive database security scanner with OWASP compliance checks, Slash Command · jeremylongshore/tons-of-skills-marketplace
- Scan Headers Quick security header check for a single URL Slash Command · jeremylongshore/tons-of-skills-marketplace