本文へ移動
cccskills
無料GitHub で公開

ln-761-secret-scanner

Scans codebase for hardcoded secrets. Returns normalized findings with severity and remediation guidance. Pre-commit hook integration.

tensology/decisionsai
インストール方法を見る

含まれるファイル（4）

  • SKILL.md3.9 KB
  • references/detection_patterns.md2.8 KB
  • references/gitleaks_config_template.toml1.4 KB
  • references/remediation_guide.md3.4 KB

SKILL.md（原文）

インストールする前に、エージェントに与えられる指示の中身を確認できます。

Paths: File paths (shared/, references/, ../ln-*) are relative to skills repo root. If not found at CWD, locate this SKILL.md directory and go up one level for repo root.

Secret Scanner

Scans codebase for hardcoded secrets and credentials, returning structured findings for remediation.

Purpose & Scope

  • Detect hardcoded secrets using available tools (gitleaks, trufflehog) or manual patterns
  • Classify findings by severity (Critical/High/Medium/Low)
  • Filter false positives via baseline and allowlists
  • Provide remediation guidance per finding type
  • Return normalized report to parent orchestrator (ln-760)

When to Use

  • During project bootstrap (via ln-760-security-setup)
  • Pre-commit hook validation
  • CI/CD security pipeline
  • Manual security audit

Workflow

Phase 1: Tool Detection

Step 1: Check Available Scanners

  • Check if gitleaks is installed (preferred)
  • Check if trufflehog is installed (alternative)
  • If neither available: use manual pattern matching as fallback

Step 2: Load Configuration

  • Load project .gitleaks.toml if exists (custom rules)
  • Load .gitleaksbaseline if exists (known false positives)
  • If no config: use default patterns from references/detection_patterns.md

Phase 2: Scan Execution

Step 1: Run Available Scanner

  • Execute scanner against project root
  • Capture output in structured format (JSON/SARIF preferred)
  • If tool unavailable: run manual grep patterns for high-confidence secrets

Step 2: Parse Results

  • Normalize output to common format: file, line, pattern, raw_match
  • Preserve original severity if provided by tool

Phase 3: Report Generation

Step 1: Severity Classification

  • Map findings to severity levels per references/detection_patterns.md
  • Critical: AWS keys, private keys, JWT secrets
  • High: Generic passwords, connection strings
  • Medium: API keys (may be test data)
  • Low: Potential secrets requiring manual review

Step 2: False Positive Filtering

  • Apply baseline exclusions
  • Apply allowlist patterns (placeholders, test data, docs)
  • Mark filtered items as "excluded" with reason

Step 3: Build Report

  • Group findings by severity
  • Include file path, line number, pattern matched
  • Do NOT include actual secret values in report

Phase 4: Remediation Guidance

Step 1: Attach Remediation Actions

  • For each finding, attach remediation steps from references/remediation_guide.md
  • For Critical findings: emphasize immediate rotation requirement

Step 2: Return Results

  • Return structured findings list to orchestrator
  • Include summary: total scanned, total found, by severity

Critical Rules

  1. Never log actual secret values - redact in all outputs
  2. Treat any found secret as compromised - rotation required for Critical
  3. Preserve baseline - do not remove existing baseline entries
  4. Pre-commit priority - recommend pre-commit hook if not configured
  5. Git history awareness - warn if secret may exist in history (requires git-filter-repo)

Definition of Done

  • Scan completed using available tool or manual patterns
  • Findings classified by severity
  • False positives filtered via baseline/allowlist
  • Remediation guidance attached to each finding
  • Report returned in normalized format (no raw secret values)
  • Critical findings flagged with rotation requirement

Reference Files

FilePurpose
references/detection_patterns.mdSecret patterns by confidence level
references/gitleaks_config_template.tomlTemplate for project gitleaks config
references/remediation_guide.mdRotation procedures by secret type

Version: 2.0.0 Last Updated: 2026-01-10

レビュー

まだレビューはありません。使ってみた感想をお寄せください。

ログインしてレビューを書く

同じリポジトリのスキル

概要と使いどころ

accessibility

無料

Design, implement, and audit inclusive digital products using WCAG 2.2 Level AA standards. Use this skill to generate semantic ARIA for Web and accessibility traits for Web and Native platforms (iOS/Android).

日本語の概要は準備中です。原文の説明を表示しています。

tensology/decisionsai172026年10月13日 更新

accessibility-audit

無料

Whole site or product — a full web accessibility (a11y) audit against WCAG 2.2, following the WCAG-EM methodology. Defines scope, samples representative pages and flows, runs the automated tier (`accessibility-scan`) and the hands-on manual tier (`accessibility-inspect`), and produces one conformance report. Grades each finding by severity and evidence basis, and states per-criterion conformance as pass, fail, or undetermined (needs a human). Use it for 'audit my site for accessibility', 'is this product accessible', 'a11y audit', 'WCAG or Section 508 conformance report', or any multi-page assessment. Assesses; does not fix (use `accessibility-fix`) or diff (use `accessibility-diff`). For a single page use `accessibility-scan`; for hands-on keyboard and screen-reader checks use `accessibility-inspect`.

日本語の概要は準備中です。原文の説明を表示しています。

tensology/decisionsai172026年10月13日 更新

accessibility-diff

無料

Regression check — diff a live page's web accessibility (a11y) violations against a baseline. By default it compares your uncommitted changes (stash-based); pass `--branch [<name>]` to compare against a branch. Reports the new WCAG violations introduced, the ones fixed, and the count of pre-existing ones. Use it for 'did my change break accessibility', 'what a11y issues did this PR add', or as a CI gate. For a full scan of one page use `accessibility-scan`; for a whole site use `accessibility-audit`.

日本語の概要は準備中です。原文の説明を表示しています。

tensology/decisionsai172026年10月13日 更新

accessibility-fix

無料

Remediation only — repair web accessibility (a11y) violations against WCAG 2.2 with a baseline, edit, and verify loop. Takes a target (URL, files, directory) or a findings worklist from `accessibility-scan`/`accessibility-inspect`/`accessibility-audit`, applies mechanical fixes as given, leaves TODOs for visual or contextual judgment, and verifies by re-running the baseline check. It only fixes. To find issues use `accessibility-scan` (one page, automated), `accessibility-inspect` (one page, manual), or `accessibility-audit` (whole site, WCAG-EM); to check for regressions use `accessibility-diff`. Use it for 'fix the a11y issues in X', 'make this accessible', 'add missing alt text and labels', 'apply these accessibility fixes', 'remediate these violations'.

日本語の概要は準備中です。原文の説明を表示しています。

tensology/decisionsai172026年10月13日 更新

accessibility-inspect

無料

One page, hands-on manual tier — drive a live page through the web accessibility (a11y) checks a rule engine can't decide: keyboard operation and focus order, screen-reader names, roles and states from the accessibility tree, reflow and zoom, reduced motion, form errors, and target size. Grades each finding by evidence basis (verified / confirm-with-a-human / human-required) and severity, and closes every criterion in a ledger: verified, flagged, not exercised, or N/A. Locates and assesses; does not fix (use `accessibility-fix`). Use it for keyboard testing, focus-order checks, screen-reader or a11y-tree review, reflow and zoom at 200%, or 'is this operable, not just lint-clean'. The automated tier is `accessibility-scan`; `accessibility-audit` runs both across a sampled site.

日本語の概要は準備中です。原文の説明を表示しています。

tensology/decisionsai172026年10月13日 更新

accessibility-scan

無料

One page, automated tier — run the web accessibility (a11y) rule engine against a live page and locate every violation it can detect mechanically. Pass a URL, a config target name (e.g. `accesslint:accessibility-scan dev`), or nothing to use the default target from `accesslint.config.json`. Ensures a debuggable Chrome, runs the @accesslint/core engine over CDP, and returns a worklist of live-DOM WCAG 2.2 violations, each grounded to its DOM selector and source `file:line`. Locates; doesn't edit. Use it for 'is this page accessible', 'check a11y on this URL', 'find contrast and alt-text issues', or to verify a UI change. For hands-on keyboard and screen-reader checks use `accessibility-inspect`; for a whole site or product use `accessibility-audit`; to diff against uncommitted changes or a branch use `accessibility-diff`.

日本語の概要は準備中です。原文の説明を表示しています。

tensology/decisionsai172026年10月13日 更新

tensology のスキルをすべて見る

このスキルの問題を報告する