secrets-audit
Hunt for hardcoded secrets, credentials, API keys, tokens, and other sensitive values in source code and config files
Skill by jcvernaleo
Chalk Labs
Need help deploying secrets-audit?
Chalk Labs sets up agents like this inside real teams: connected to your tools, tested on your data, with a human in the loop where it matters.
Install
Works with Claude Code, Claude apps, Codex, Cursor, Gemini CLI, GitHub Copilot, VS Code, OpenCode, Goose, Windsurf. Read the repository before you give any tool access to your data.
npx agentmarket install skill/jcvernaleo-secrets-audit
Asks which of your tools to add it to (Claude Code, Codex, Cursor, VS Code, Windsurf, Gemini CLI, Claude Desktop) and shows the change first. See https://agentmart.dev/cli.
Get the weekly diff
The weekly diff: one email a week with new agent tools, notable updates and grade changes, plus security alerts for tools you follow. Double opt-in, one-click unsubscribe.
About
Use cases: backend, security
Reviews
Write a reviewNo reviews yet. Installed it? Reviews come from verified installers only. How reviews work
Permissions
What this skill can do and what it asks for, from its SKILL.md. Checked Oct 25, 2026.
- Tools
- No tools found
- Secrets
- None asked for
- Install scripts
- None found
Network hosts it talks to 1
codeload.github.com· found in install command
Files it touches
~/.claude/skills/secrets-audit
Tools it pre-approves 9
From allowed-tools in SKILL.md: the agent may use these without asking you each time.
Read,Grep,Glob,Bash(find*),Bash(gitlogshow*)
What's inside
- Skill name
secrets-audit- Description
- Hunt for hardcoded secrets, credentials, API keys, tokens, and other sensitive values in source code and config files
- License
- ISC
- Allowed tools
- Read,, Grep,, Glob,, Bash(find, *),, Bash(git, log, *),, Bash(git, show, *)
- Instructions
- 31 lines in SKILL.md · view on GitHub
Before installing
- Pre-approves some shell commands
Files (1)
- SKILL.md
SKILL.md (first lines)
Scan $ARGUMENTS for hardcoded secrets and sensitive credential exposure. ## Patterns to Search For **High-signal string patterns** (grep these): - `password`, `passwd`, `pwd`, `secret`, `api_key`, `apikey`, `access_token`, `auth_token`, `private_key`, `client_secret` - Assignment patterns: `= "..."`, `= '...'` near the above - Base64-looking strings 40+ chars in assignments - Patterns resembling: AWS (`AKIA`), GCP service account JSON, Stripe (`sk_live_`), GitHub PAT (`ghp_`), Slack webhook URLs **Files to prioritize:** - `.env`, `.env.*`, `config.*`, `settings.*`, `application.properties`, `*.yml`, `*.yaml`, `*.json`, `*.xml`, `*.ini`, `*.toml` - Anything in `/config/`, `/secrets/`, `/credentials/` - Docker-related: `Dockerfile`, `docker-compose.yml` **Git history check** (if in a git repo): - Check `git log --all --oneline` for commits mentioning "key", "secret", "token", "password", "credential", "fix leak" - If any look suspicious, examine with `git show <hash>` ## Output Format For each finding: - **File:Line** - **Type** (e.g., AWS key, database password, JWT secret) - **Severity**: Critical (live/production credential), High (credential pattern, likely real), Medium (placeholder or test value) - **The line** (redact the actual secret value in your output with `[REDACTED]`) - **Remediation**: move to env var / secrets manager, rotate immediately if live Produce a summary count at the top.
From jcvernaleo/llm-scripts, ISC.
More from jcvernaleo/llm-scripts
- 0.581score
audit
jcvernaleo
Perform a smart contract security audit using the SCAR methodology.
SkillAFreshness: A★ 1Claude Code +9 - 0.581score
audit-report
jcvernaleo
Generate a combined PDF report from all audit markdown files.
SkillAFreshness: A★ 1Claude Code +9 - 0.494score
vuln-scan
jcvernaleo
Audit web application source code for common vulnerability classes (XSS, SQLi, SSRF, path traversal, command injection, insecure deserialization, etc.)
SkillCFreshness: C★ 1Claude Code +9 - 0.494score
authz-review
jcvernaleo
Review web application route/endpoint definitions and business logic for broken access control, privilege escalation, and IDOR vulnerabilities
SkillCFreshness: C★ 1Claude Code +9 - 0.491score
new-workspace
jcvernaleo
Create a new multi-repo umbrella workspace in the current directory.
SkillCFreshness: C★ 1Claude Code +9 - 0.491score
depcheck
jcvernaleo
Review dependency manifest files for dangerous, deprecated, or vulnerable package patterns
SkillCFreshness: C★ 1Claude Code +9 - 0.488score
save-session
jcvernaleo
Save the current session state.
SkillCFreshness: C★ 1Claude Code +9 - 0.488score
status
jcvernaleo
Show current project state without taking action.
SkillCFreshness: C★ 1Claude Code +9 - 0.488score
sessions
jcvernaleo
List recent session logs across all projects.
SkillCFreshness: C★ 1Claude Code +9 - 0.488score
resume
jcvernaleo
Resume the project from saved state.
SkillCFreshness: C★ 1Claude Code +9 - 0.264score
sqli-deep
jcvernaleo
No description from the publisher yet.
SkillCFreshness: C★ 1Claude Code +9 - 0.264score
full-audit
jcvernaleo
No description from the publisher yet.
SkillCFreshness: C★ 1Claude Code +9
Signals
- Stars
- 1
- Forks
- 0
- Open issues
- 0
- Last commit (this folder)
- May 6, 2026 (6 months ago)
From GitHub (fetched Oct 24, 2026).
Details
- License
- ISC
- Repository
- github.com/jcvernaleo/llm-scripts
- First seen
- Oct 24, 2026
- Last checked
- Oct 24, 2026
- Source
- GitHubgithub-graphql
More from jcvernaleo
- 0.581score
audit
jcvernaleo
Perform a smart contract security audit using the SCAR methodology.
SkillAFreshness: A★ 1Claude Code +9 - 0.581score
audit-report
jcvernaleo
Generate a combined PDF report from all audit markdown files.
SkillAFreshness: A★ 1Claude Code +9 - 0.494score
vuln-scan
jcvernaleo
Audit web application source code for common vulnerability classes (XSS, SQLi, SSRF, path traversal, command injection, insecure deserialization, etc.)
SkillCFreshness: C★ 1Claude Code +9 - 0.494score
authz-review
jcvernaleo
Review web application route/endpoint definitions and business logic for broken access control, privilege escalation, and IDOR vulnerabilities
SkillCFreshness: C★ 1Claude Code +9 - 0.491score
depcheck
jcvernaleo
Review dependency manifest files for dangerous, deprecated, or vulnerable package patterns
SkillCFreshness: C★ 1Claude Code +9 - 0.491score
new-workspace
jcvernaleo
Create a new multi-repo umbrella workspace in the current directory.
SkillCFreshness: C★ 1Claude Code +9
Done for you
Rather not set it up yourself?
Chalk Labs scopes, builds and runs agents for your team: the task audit, the eval harness, the integrations and the weekly ops report. Fixed scope, priced before we start.
See how we build AI agents →Read the case studies
Chalk Labs is a two-founder AI and growth studio. We build AI agents, CRMs and MVPs for Web3 and AI companies, and have shipped 50+ product and token launches.
- launches shipped
- 50+
- launches shipped
- media placements
- 500+
- media placements
- founders on every account
- 2
- founders on every account
Press we've placed: Forbes · CoinDesk · Decrypt · Cointelegraph · The Block
Rahil Jain, Co-founder, Chalk Labs. Ex-Goldman Sachs engineer. You talk to the person who builds it.
Get secrets-audit running in your business
Tell us what you want to automate. A founder replies within one working day with a plan, not a pitch deck.
Cite this page
secrets-audit skill. Agent Mart. https://agentmart.dev/skills/jcvernaleo-secrets-audit (last updated 2026-10-24)