A specialized security analysis tool for detecting hardcoded secrets, API keys, and credential misconfigurations within Infrastructure as Code (IaC) and configuration files.
Install & Download
1. ClawHub CLI
The fastest way to install a skill directly from the registry.
npx clawhub@latest install secrets-scanner
2. Manual Installation
Copy the skill folder to one of these locations
~/.openclaw/skills/ <project>/skills/ Priority: Workspace > Local > Bundled
3. Prompt Installation
Copy this prompt to OpenClaw to install it automatically.
Help me install secrets-scanner using Clawhub. If Clawhub is not installed, install it first (npm i -g clawhub).
Prefer to download?
Get the raw skill files in a ZIP archive.
What is AWS Secrets & Credential Exposure Scanner?
The AWS Secrets & Credential Exposure Scanner is a professional-grade security tool designed to act as a safeguard for cloud developers. By analyzing your configuration files and environment variable schemas, this skill identifies critical risks like exposed AWS Access Key IDs, Secret Access Keys, and third-party API keys from services like Stripe, Twilio, and Slack. It is a key component for any developer looking to strengthen their security posture using Openclaw Skills.
This tool operates on an instruction-only basis, meaning it never accesses your AWS account directly. Instead, it processes data you provide—such as Terraform HCL, CloudFormation YAML, or CLI outputs—to provide actionable remediation steps, migration plans for AWS Secrets Manager, and git history cleanup strategies. It serves as an expert auditor to ensure no sensitive credentials leak into your repositories or production environments.
AWS Secrets & Credential Exposure Scanner Use Cases
- Scanning Terraform, CloudFormation, or CDK files for plain-text credentials before deployment.
- Reviewing Lambda function and ECS task definition environment variables for security best-practice violations.
- Auditing configuration files for high-entropy strings, JWT secrets, and private SSH keys.
- Generating a structured migration plan to move hardcoded secrets into AWS Secrets Manager or Parameter Store.
- Cleaning up sensitive data from git history using specialized remediation commands.
How AWS Secrets & Credential Exposure Scanner Works
- The user provides IaC file contents or JSON outputs from specific AWS CLI read-only commands.
- The skill scans the provided data for known secret patterns and high-entropy strings.
- Findings are classified by type (e.g., AWS Key, Database String, API Key) and assigned a severity level.
- The tool estimates the potential blast radius, determining which AWS services or accounts could be compromised.
- A comprehensive report is generated, including a findings table, a migration plan to secure storage, and git remediation steps.
AWS Secrets & Credential Exposure Scanner Setup
To use this scanner effectively within the framework of Openclaw Skills, you should have the AWS CLI installed to export necessary metadata. Use the following read-only IAM policy to gather the required data safely:
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": ["lambda:GetFunctionConfiguration", "ecs:DescribeTaskDefinition", "ssm:DescribeParameters"],
"Resource": "*"
}]
}
You can then provide environment variable keys for analysis using commands like:
aws lambda get-function-configuration --function-name YOUR_FUNCTION --query 'Environment.Variables' --output json
AWS Secrets & Credential Exposure Scanner Data Schema & Taxonomy
The skill organizes its security analysis into a structured output format for easy integration into devsecops workflows:
| Data Point | Description |
|---|---|
| Critical Findings | Immediate credential risks that require urgent rotation. |
| Findings Table | A detailed list containing File, Line Number, Secret Type, Severity, and Blast Radius. |
| Migration Plan | Configuration snippets for AWS Secrets Manager and SDK code examples. |
| Git Remediation | Specific CLI commands for BFG Repo-Cleaner or git-filter-repo. |
| Prevention | Configuration templates for pre-commit hooks and AWS CodeGuru Secrets detector. |
AWS Secrets & Credential Exposure Scanner Advanced Features
- Blast radius estimation to quantify the security impact of a specific credential leak.
- Automated generation of BFG Repo-Cleaner and git-filter-repo commands for rapid incident response.
- SDK-specific code snippets to help developers transition from environment variables to AWS Secrets Manager.
- Support for a wide array of third-party secret patterns including Stripe, Twilio, SendGrid, and Slack.
- Pre-commit hook configuration guidance to prevent future leaks, enhancing the long-term value of Openclaw Skills.
SKILL.md
Loading
Related Openclaw Skills
AWS S3 Exposure Auditor
A security auditing skill that identifies misconfigured S3 buckets and generates hardened policies using your exported AWS data.
AWS RI and Savings Plans Advisor
An AI-driven financial advisor that analyzes AWS usage data to recommend the most cost-effective Reserved Instance and Savings Plan strategies.
Azure Reservations & Hybrid Benefit Advisor
An AI-driven advisor that analyzes Azure usage data to recommend optimal Reservation and Hybrid Benefit stacking for maximum cost savings.
Azure NSG & Firewall Auditor
A specialized security analysis tool for auditing Azure Network Security Groups and Firewall policies to eliminate dangerous internet exposure.
AWS Security Group Auditor
An instruction-based security auditor that analyzes AWS security group exports to identify dangerous internet exposure and provide hardened remediation rules.
AWS Spend Analyzer
A professional FinOps analysis tool that processes AWS billing data to identify cost-saving opportunities and expenditure anomalies.
Featured*
