Secret Scanner

Hooks security 1,359 Scanned by NVIDIA SkillSpector

Automatically detects hardcoded secrets before git commits. Scans for API keys from 30+ providers (Anthropic: sk-ant-..., OpenAI: sk-..., AWS: AKIA..., Stripe: sk_live_..., Google: AIza..., GitHub: ghp_..., Vercel, Supabase, Hugging Face: hf_..., Replicate: r8_..., Groq: gsk_..., Databricks: dapi..., GitLab, DigitalOcean, npm, PyPI, and more), tokens, passwords, private keys, and database credentials. Blocks commits containing secrets and suggests using environment variables instead.

Install Command

npx claude-code-templates@latest --hook security/secret-scanner

View on GitHub

claude-code — secret-scanner

Scanned by NVIDIA SkillSpector

Automated static analysis (no LLM) · v2.12.0 · 2026-10-17

15 observations

scanner score 59/100

SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.

Credential Access ×11
Privilege Escalation · secret-scanner.py:28
Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, shell.
MCP Least Privilege · SKILL.md:1
subprocess module call ×3
Dangerous Code Execution · secret-scanner.py:191

Learn more about NVIDIA SkillSpector.

Content

JSON

{

"description": "Automatically detects hardcoded secrets before git commits. Scans for API keys f..."

"hooks": {

"PreToolUse": [1 item]

}

Secret Scanner

Scanned by NVIDIA SkillSpector

Content

Stack Builder