Stats
Actions
Tags
From secret-scan
Use when a secret may have been committed or is about to be. Covers high-signal detection patterns and the correct remediation order — rotate the credential first, then remove it from code and history. Always redact when reporting.
How this skill is triggered — by the user, by Claude, or both
Slash command
/secret-scan:secret-remediationThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
A committed secret should be treated as **compromised the moment it lands**, even in a
A committed secret should be treated as compromised the moment it lands, even in a private repo. The clock starts at commit time, not at discovery.
AKIA…/ASIA…), GCP/Azure key blobs.ghp_…, github_pat_…), Slack (xox…), Stripe (sk_live_…),
npm, PyPI tokens.-----BEGIN … PRIVATE KEY----- block.scheme://user:password@host/db with embedded credentials.*secret*, *token*,
*password*, *api*key*, especially in .env, config, or CI files.Filter false positives: placeholders (example, changeme, xxxx), test fixtures, and
documented sample values.
git filter-repo
or BFG) and force-push, then have collaborators re-clone. Rotation (step 1) matters more
than a clean history — a rotated secret in old history is harmless..gitignore, add a pre-commit secret scan, and
document where the real value lives.AKIA****), never the full value — the report
itself can leak.Provides CDSS development patterns for drug interaction checking, dose validation, clinical scoring (NEWS2, qSOFA), and alert classification integrated into EMR workflows.
npx claudepluginhub meaganewaller/rosetta --plugin secret-scan