Secret Leak Scan

Your build artifacts and repository history might contain plaintext credentials that lead to immediate account takeovers. This skill performs static analysis on project directories, build outputs, and Electron .asar archives to find leaked secrets before they are committed or released.

What it does

• Multi-format scanning analyzes source code, minified build artifacts, and packed .asar bundles.
• Credential detection identifies AWS keys, GitHub PATs, Slack tokens, Stripe live keys, and Google API keys.
• Private key auditing flags exposed private key blocks often found in SSH or SSL configurations.
• Safe reporting generates JSON findings with masked fingerprints to prevent further exposure of raw values.
• Triage assistance maps findings to specific files and lines with clear rotation instructions.

How it works

1. Target selection involves specifying the project root, a distribution folder like dist/, or a packaged app bundle.
2. Analysis execution runs the bundled Node.js script to perform pattern matching across the file tree.
3. Report processing parses the resulting JSON to count findings and categorize them by service type.
4. Remediation delivery produces a prioritized list of leaked credentials and rotation steps.

Frameworks & tools

The scanner requires Node.js 18 or later. It uses @electron/asar for archive inspection and is compatible with any CI/CD environment that supports custom shell scripts and exit codes.

Why this beats prompting it yourself

Generic prompts often miss secrets hidden in large minified files or binary archives. This skill uses a dedicated script for consistent pattern matching and provides a structured remediation workflow that treats every match as a high-priority security event.

Use cases

• Pre-commit checks to prevent developers from pushing plaintext API keys to remote repositories.
• Release auditing to ensure production build folders don't contain sensitive config files.
• Electron app hardening by scanning packed .asar files for accidentally bundled environment variables.
• Post-incident cleanup by identifying which credentials were leaked and require immediate rotation.

Known limitations

Static analysis cannot detect secrets split across lines or custom token formats. It does not check historical git commits unless the files currently exist in the working tree.