secret-scan — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited secret-scan (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Find secrets that should never be in source control, then advise on remediation. Default scope: the staged diff if there is one, otherwise the working tree. Scan history or a specific path only when asked.
AKIA…, GCP, Azure), provider API tokens (Stripe, GitHub ghp_…, Slack, OpenAI, etc.), OAuth client secrets, JWTs.-----BEGIN … PRIVATE KEY----- blocks, .pem / .p12 / keystore contents.scheme://user:pass@host), basic-auth headers.password, secret, token, api_key, access_key, client_secret, plus high-entropy strings that look like keys..env, credential JSON, *.key, and their presence in history.Distinguish real secrets from example/placeholder values (xxxxx, your-key-here, changeme), test fixtures, public keys, and sample docs. When genuinely unsure, label a finding "review" rather than asserting a leak, but err toward reporting over silence.
For each finding give: the file and line, the kind of secret, and a confidence (high / review). Then recommend remediation:
.gitignore; consider a pre-commit hook or scanner to prevent recurrence.This is a defensive check. Report findings so the owner can secure their own project; do not exfiltrate, store, or transmit any secret you find.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.