An AI-powered repository auditing tool designed to scan workspace trees for exposed credentials, tokens, and misconfigured .gitignore files prior to pushing online.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install code-security-check
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install code-security-check using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Code Security Check?
The Code Security Check skill provides developers with an intelligent, automated method to discover sensitive data leaks before code reaches public environments. Unlike conventional tools that depend on rigid regex pattern databases or brittle matching rules, this capability relies directly on large language models to interpret contextual code files. This enables it to accurately recognize novel key variations, analyze structural intent, and completely bypass regular documentation examples or false positives.
Operating natively within Openclaw Skills, this mechanism inspects active project trees for exposed API tokens, database keys, private security configurations, and unmapped tracking matrices. It evaluates remote accessibility statuses upfront to protect sensitive components without impacting workflow execution times on localized codebases.
Code Security Check Use Cases
- Scanning active workspaces for accidentally hardcoded cloud credentials, tokens, or private encryption keys.
- Reviewing tech-stack-specific coverage rules across localized .gitignore files before converting a codebase to open source.
- Discovering uncommitted, high-risk metadata tracking elements lurking within active development directories.
- Validating repository hosting configurations to guarantee that production secrets remain contained away from public git mirrors.
How Code Security Check Works
- Executes an exposure risk assessment gate check by auditing localized git tracking statuses, active remote linkages, and private visibility indicators.
- Performs technology stack discovery by scanning root environments for framework indicators like package.json, pyproject.toml, or go.mod.
- Conducts a structural configuration audit to verify whether essential tech-stack ignore paths are properly declared within .gitignore.
- Utilizes targeted glob patterns and quick content pre-filters to flag highly suspicious secret containers and private certificates.
- Employs deep AI context analysis on targeted files to isolate operational production credentials while redacting actual string secrets.
- Generates a comprehensive risk breakdown matrix summarizing tech metrics, tracking gaps, and classified severity tables.
Code Security Check Setup
Prerequisites
Ensure your agent environment has access to the local git CLI interface and GitHub CLI toolset for maximum functionality.
Usage
Trigger the automated auditing process by invoking target terms natively in conversation with the agent:
# Example conversational triggers
"check for secrets before pushing to GitHub"
"scan for API keys and check my .gitignore"
Code Security Check Data Schema & Taxonomy
The skill scans project structures and compiles operational analysis across structural parameters. Data findings are sorted dynamically through the following metadata severity schema:
| Level | Target Scope & Definitions |
|---|---|
| Critical | Production environment API tokens, active private keys, platform permissions, and live system credentials. |
| High | Service tokens, internal microservice configurations, and active keys identified outside ignored paths. |
| Medium | Structural configurations missing standard security omissions, unmapped files, or credential assignments. |
Structural Scanned Matrix
File structures matched during search queries include target extensions such as:
**/.env*configuration paths**/credentials*.jsonmetadata infrastructure files**/*.pem,**/*.key,id_rsacertificates
Code Security Check Advanced Features
- Context-aware AI structural analysis that automatically distinguishes between real secrets and placeholder documentation mock strings.
- Dynamic gatekeeping loops that cleanly terminate background scanning executions if repositories lack public remote routes.
- Targeted staging support which targets working trees explicitly while omitting binary archives and dependency directories.
- Post-audit interactive remediation protocols supporting secure untracking operations using specialized cleanups like git rm --cached.
SKILL.md
Loading
Related Openclaw Skills
The Black Girl's Guide to Financial Freedom Skill
An AI agent skill translating Paris Woods' wealth-building framework into a personalized, actionable financial toolkit.
WeChat Chat Record Generator
An automation skill for generating structured WeChat group chat logs in Excel format using parallel multi-agent simulations.
BTC Contract Scanner Free
An automated technical analysis scanner that evaluates BTC/USDT contracts across dual timeframes using five indicators and returns structured decision JSONs.
BTC Contract Scanner Pro
An advanced, self-optimizing multi-strategy contract scanner for BTC, ETH, and SOL featuring walkforward parameter optimization, automated risk safeguards, and Telegram integration.
Love Yourself First
An actionable AI coaching skill implementing Marc Reklau's 30-day framework to silence your inner critic and choose unconditional self-worth.
AgentLens Blog Feed
A dedicated discovery and de-duplication skill that fetches the latest AgentLens blogs and tracks them locally so your AI agent only processes each blog exactly once.
Featured*
