secret-patterns
30+ service-specific secret detection regex patterns, entropy-based detection, PEM/JWT/Base64 identification, and false positive filtering.
npx skills add vibeeval/vibecosystem --skill secret-patterns --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Secret Detection Patterns Patterns for finding leaked credentials in codebases, git history, and CI logs. ## AWS Credentials ```bash # Access Key ID: always starts with AKIA (long-term) or ASIA (session) AKIA[0-9A-Z]{16} ASIA[0-9A-Z]{16} # Secret Access Key: 40-char base64-ish string after aws_secret aws_secret_access_key\s*=\s*[A-Za-z0-9/+=]{40} # ripgrep one-liner rg --no-heading -n '(AKIA|ASIA)[0-9A-Z]{16}' . ``` ## GitHub Tokens ```bash # Personal access tokens (classic and fine-grained) ghp_[A-Za-z0-9]{36} github_pat_[A-Za-z0-9_]{82} # OAuth / app tokens gho_[A-Za-z0-9]{36} ghs_[A-Za-z0-9]{36} ghu_[A-Za-z0-9]{36} ghr_[A-Za-z0-9]{36} rg --no-heading -n 'gh[pousr]_[A-Za-z0-9]{36}' . ``` ## Stripe Keys ```bash # Live secret (never commit) sk_live_[A-Za-z0-9]{24,} # Test secret (flag but lower severity) sk_test_[A-Za-z0-9]{24,} # Publishable keys (public, lower severity) pk_live_[A-Za-z0-9]{24,} pk_test_[A-Za-z0-9]{24,} rg --no-heading -n 'sk_(live|test)_[A-Za-z0-9]{24,}' . ``` ## OpenAI / Anthropic Keys ```bash # OpenAI sk-proj-[A-Za-z0-9\-_]{50,} sk-[A-Za-z0-9]{48} # Anthropic sk-ant-[A-Za-z0-9\-_]{90,} rg --no-heading -n '(sk-proj-|sk-ant-)' . ``` ## JWT Tokens ```bash # Thre
- AWS Credentials
- GitHub Tokens
- Stripe Keys
- OpenAI / Anthropic Keys
- JWT Tokens
- PEM Private Keys
- Slack Tokens
- Database Connection Strings
- NPM, SendGrid, Twilio, Mailgun
- SSH Private Keys
- Google Service Account JSON
- High-Entropy String Detection (Shannon Entropy)
- False Positive Filtering Rules
- Pre-commit Hook Integration
Access Key ID: always starts with AKIA (long-term) or ASIA (session)
Secret Access Key: 40-char base64-ish string after aws_secret
ripgrep one-liner
rg --no-heading -n '(AKIA|ASIA)[0-9A-Z]{16}' .
Personal access tokens (classic and fine-grained)
OAuth / app tokens
rg --no-heading -n 'gh[pousr]_[A-Za-z0-9]{36}' .
Live secret (never commit)
Test secret (flag but lower severity)
Publishable keys (public, lower severity)What does the secret-patterns skill do?
30+ service-specific secret detection regex patterns, entropy-based detection, PEM/JWT/Base64 identification, and false positive filtering.
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill secret-patterns --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.