A high-performance security scanner for detecting hardcoded credentials, API keys, and sensitive tokens within codebases and git histories.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install secrets-audit
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install secrets-audit using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is Secrets Audit?
The Secrets Audit tool is a critical security extension for Openclaw Skills designed to prevent credential leaks and data breaches. It performs deep scans of project directories, configuration files, and environment variables to identify high-entropy strings, hardcoded passwords, and private keys. By integrating this skill, developers can ensure their source code remains secure and compliant with modern security standards.
This tool does more than just identify potential leaks; it classifies findings by severity and provides actionable remediation steps to help you rotate compromised credentials effectively. It is particularly valuable for teams looking to bolster their security posture before pushing code to production or public repositories using Openclaw Skills.
Secrets Audit Use Cases
- Audit a new project for hardcoded API keys or database connection strings.
- Scan git history to ensure no secrets were accidentally committed in previous versions.
- Verify .env files and configuration settings before deploying to a cloud environment.
- Review the security of a codebase during a handoff or open-source release.
- Detect high-entropy strings that might indicate obfuscated tokens or sensitive data leaks.
How Secrets Audit Works
- The skill initiates a recursive directory walk, automatically skipping dependency folders, lock files, and binary files.
- It applies over 40 specialized regex patterns and calculates Shannon entropy for potential secrets that do not follow standard patterns.
- All findings are deduplicated and assigned a severity level (High, Medium, or Low) based on the risk profile.
- A structured report is generated, highlighting the specific file, line number, and code context of the exposure.
- The skill provides tailored remediation advice, such as environment variable usage, .gitignore updates, or secret rotation instructions.
Secrets Audit Setup
Ensure you have the necessary scripts within your local environment. You can run the scanner via the CLI with the following commands:
# Full project scan
python3 scripts/scan_secrets.py /path/to/project
# Scan with git history check to find deleted secrets
python3 scripts/scan_secrets.py /path/to/project --git-history
# Scan specific file types only
python3 scripts/scan_secrets.py /path/to/project --extensions .py,.js,.env
# JSON output for CI integration
python3 scripts/scan_secrets.py /path/to/project --format json
Secrets Audit Data Schema & Taxonomy
The Secrets Audit skill organizes findings into a severity-ranked taxonomy to prioritize remediation efforts.
| Severity | Description | Examples |
|---|---|---|
| High | Immediate risk of exploit | AWS Keys, DB Passwords, SSH Private Keys |
| Medium | Configuration vulnerabilities | .env files, Hardcoded URLs with auth |
| Low | Informational or low-risk | TODO comments, Placeholder/test credentials |
The system also respects exclusion lists to reduce noise, ignoring node_modules, .git directories, and minified assets.
Secrets Audit Advanced Features
- Git history deep scanning to uncover deleted or modified secrets in past commits that still exist in the repository metadata.
- CI/CD integration with specific exit codes (0, 1, 2) to block deployments if high-severity secrets are detected.
- Custom file extension filtering to focus scans on high-risk sensitive file types like .env, .yml, or .json.
- High-entropy string detection for identifying non-patterned sensitive data like encryption keys or custom tokens.
- Seamless support for pre-commit hooks to automate security checks within Openclaw Skills workflows.
SKILL.md
Loading
Related Openclaw Skills
Verified Agent Identity
A comprehensive toolkit for AI agents to manage decentralized identities, sign challenges, and establish verifiable links to human owners on the Billions Network.
PR Description Generator
A Python-based tool that automates the creation of structured pull request descriptions by analyzing git diffs and commit history.
Gojek Company Research Skill
A specialized research skill for analyzing Gojek’s ecosystem, from its origins as a motorcycle hailing service to its evolution into the GoTo Group super app powerhouse.
F1 Formula Analysis
A specialized analytical tool for understanding the business evolution, economic structure, and global expansion of Formula 1 racing.
Service Catalog
An automated infrastructure discovery tool that builds a living service inventory by scanning Docker, Kubernetes, and application configurations.
CSP Policy Generator
A specialized security utility to generate, validate, and refine Content Security Policy (CSP) headers through automated resource discovery and risk analysis.
Featured*
