secret-scanner
Pre-push API key and credential scanner - blocks git push if secrets found
npx skills add vibeeval/vibecosystem --skill secret-scanner --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Secret Scanner Scans your codebase for leaked API keys, tokens, and credentials. Blocks git push if secrets are found. ## Usage ```bash # Scan current directory vibeco secrets # Scan specific path vibeco secrets /path/to/project ``` ## Detected Secrets (22 patterns) | Provider | Pattern | Example | |----------|---------|---------| | OpenAI | `sk-proj-...`, `sk-...` | `sk-proj-abc123...` | | Anthropic | `sk-ant-...` | `sk-ant-api03-...` | | AWS | `AKIA...` | `AKIAIOSFODNN7EXAMPLE` | | GitHub | `ghp_...`, `gho_...`, `github_pat_...` | `ghp_xxxxxxxxxxxx` | | Stripe | `sk_live_...`, `pk_live_...` | `sk_live_4eC39H...` | | Google | `AIza...` | `AIzaSyDaGm...` | | Slack | `xoxb-...`, `xoxp-...` | `xoxb-123-456-abc` | | SendGrid | `SG....` | `SG.xxx.yyy` | | npm | `npm_...` | `npm_xxxxxxxxxxxxx` | | PyPI | `pypi-...` | `pypi-AgEIcHl...` | | Database URLs | `postgres://`, `mongodb://`, `mysql://`, `redis://` | With embedded passwords | | Private Keys | `PRIVATE KEY-----` | PEM format | ## Auto-Setup: Git Pre-Push Hook Add to your project's `.git/hooks/pre-push`: ```bash #!/bin/bash vibeco secrets "$(git rev-parse --show-toplevel)" || exit 1 ``` Make it executable: ```bash chmod +x .git/h
- Usage
- Detected Secrets (22 patterns)
- Auto-Setup: Git Pre-Push Hook
- How It Works
- What to Do If Secrets Are Found
- Scanned File Types
Scan current directory vibeco secrets Scan specific path vibeco secrets /path/to/project vibeco secrets "$(git rev-parse --show-toplevel)" || exit 1 chmod +x .git/hooks/pre-push
What does the secret-scanner skill do?
Pre-push API key and credential scanner - blocks git push if secrets found
How do I install it?
Run `npx skills add vibeeval/vibecosystem --skill secret-scanner --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From vibeeval/vibecosystem, a repository with 521 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.