Scans git repositories for hardcoded secrets, credentials, and API keys using Gitleaks. Returns findings with severity, location, and remediation steps. Use when user asks to "scan for secrets", "detect credentials", "find API keys", "check for leaks", "シークレット検出", "認証情報スキャン".
/plugin marketplace add naporin0624/claude-web-audit-plugins/plugin install web-audit-tools@web-audit-marketplaceThis skill inherits all available tools. When active, it can use any tool Claude has access to.
dist/index.jspackage.jsonsrc/index.tssrc/types.tstsconfig.jsonWrapper for Gitleaks to detect hardcoded secrets in git repositories.
Gitleaks must be installed:
# macOS
brew install gitleaks
# Go
go install github.com/gitleaks/gitleaks/v8@latest
# Docker
docker pull zricethezav/gitleaks
# Scan current directory
npx secret-scanner .
# Scan with JSON output
npx secret-scanner . --json
# Scan specific path
npx secret-scanner /path/to/repo
# Check if gitleaks is installed
npx secret-scanner --check
{
"tool": "gitleaks",
"scanPath": ".",
"findings": [
{
"id": "aws-access-key-id",
"severity": "critical",
"description": "AWS Access Key ID detected",
"file": "config.js",
"line": 15,
"secret": "AKIA***REDACTED***",
"commit": "abc1234",
"author": "developer@example.com",
"date": "2024-01-15T10:30:00Z"
}
],
"summary": {
"total": 1,
"critical": 1,
"high": 0,
"medium": 0,
"low": 0
}
}
0: No secrets found1: Secrets detected2: Tool not installed or error| Gitleaks Rule | Severity |
|---|---|
| aws-access-key-id | critical |
| private-key | critical |
| password | high |
| api-key | high |
| token | medium |
| generic-credential | low |
This skill should be used when the user asks to "create an agent", "add an agent", "write a subagent", "agent frontmatter", "when to use description", "agent examples", "agent tools", "agent colors", "autonomous agent", or needs guidance on agent structure, system prompts, triggering conditions, or agent development best practices for Claude Code plugins.
This skill should be used when the user asks to "create a slash command", "add a command", "write a custom command", "define command arguments", "use command frontmatter", "organize commands", "create command with file references", "interactive command", "use AskUserQuestion in command", or needs guidance on slash command structure, YAML frontmatter fields, dynamic arguments, bash execution in commands, user interaction patterns, or command development best practices for Claude Code.
This skill should be used when the user asks to "create a hook", "add a PreToolUse/PostToolUse/Stop hook", "validate tool use", "implement prompt-based hooks", "use ${CLAUDE_PLUGIN_ROOT}", "set up event-driven automation", "block dangerous commands", or mentions hook events (PreToolUse, PostToolUse, Stop, SubagentStop, SessionStart, SessionEnd, UserPromptSubmit, PreCompact, Notification). Provides comprehensive guidance for creating and implementing Claude Code plugin hooks with focus on advanced prompt-based hooks API.