{
 "schema": "aiblocks-page/1",
 "id": "secrets-hygiene-checker",
 "type": "skill",
 "name": "Secret leak checker",
 "summary": "Find likely leaked credentials without copying their values into reports, then get a safe triage plan.",
 "headline": "Secret leak checker",
 "subhead": "Find likely secrets in project files. Hide their values and plan how to review and replace them.",
 "job": {
  "id": "secure-code",
  "name": "Keep your code secure"
 },
 "level": "intermediate",
 "thinking": "medium",
 "tested": true,
 "updated": "2026-10-28",
 "first_published": "2026-10-20",
 "inputs": [
  {
   "type": "codebase",
   "required": true,
   "label": "Codebase",
   "what": "a project's code, in a folder or repo the AI can open"
  }
 ],
 "outputs": [
  {
   "type": "security_report",
   "required": true,
   "label": "Security report",
   "what": "the risks found in the code, ranked, each with a fix"
  }
 ],
 "you_give": [
  "Your project folder",
  "Your current .env and .env.example setup",
  "Where secrets live in production (optional)",
  "Your CI setup (optional)"
 ],
 "you_get": [
  "A list of likely leaked secrets ranked by severity",
  "Rotation and cleanup steps",
  "A tidied env file layout",
  "A pre-merge secret scan setup"
 ],
 "use_when": [
  "You are about to push code and want to be sure no key is in it.",
  "A contributor joins and you need safe .env conventions for them.",
  "You suspect a password was committed and need a rotation plan.",
  "Your example env file might contain real values."
 ],
 "skip_when": [
  "You need to search your full git history for old leaks: run gitleaks, which can scan past commits.",
  "You want a place to store and hand out secrets in production: use a secret manager such as HashiCorp Vault or AWS Secrets Manager.",
  "You need to set up a full production vault with backups and recovery: ask a security engineer or a DevOps person."
 ],
 "output_sample": {
  "input": [
   "Your project folder",
   "Your .env and .env.example files",
   "Where secrets live in production (optional)",
   "Your CI setup (optional)"
  ],
  "prerequisites": [
   "An AI that can run Python code and read your project files",
   "Python 3 installed, to run the bundled scan script"
  ],
  "output": [
   {
    "name": "Scan findings",
    "contains": "Likely credentials found in your working files, each ranked critical, high or lower."
   },
   {
    "name": "JSON report",
    "contains": "The same findings in a format your CI checks can read, made with the --json option."
   },
   {
    "name": "Fix order",
    "contains": "Which findings to handle first, starting with critical and high ones."
   },
   {
    "name": "Rotation steps",
    "contains": "How to make a new credential, deploy it everywhere, check it works, then revoke the old one."
   },
   {
    "name": "Env file cleanup",
    "contains": "Changes to .env.example and .gitignore so examples hold no real secrets."
   },
   {
    "name": "Common mistakes",
    "contains": "Traps to avoid, like rotating one system but missing the services that depend on it."
   },
   {
    "name": "Secret store comparison",
    "contains": "How Vault, AWS, Azure and GCP secret managers differ and which fits your setup."
   },
   {
    "name": "Pre-merge scanning advice",
    "contains": "How to add secret scanning with gitleaks or detect-secrets before code is merged."
   }
  ]
 },
 "how_to_use": [
  "Open your AI in a tool that can read your project files and run code. Add the skill's instructions and its scripts folder.",
  "Tell your AI to scan your project folder. It runs python3 scripts/env_auditor.py /path/to/repo.",
  "Ask for JSON output if you want to use the results in CI. It adds the --json option.",
  "Read the critical and high findings first. Check each one is a real credential.",
  "Rotate any real credential, remove the exposed value, then fix your .env.example and .gitignore.",
  "Ask your AI to set up secret scanning before merge, so new leaks get caught."
 ],
 "checks": [],
 "next": [
  {
   "name": "Project secrets and package risk review",
   "url": "https://useaiblocks.com/skills/weekly-dependency-and-security-sweep",
   "why": "Project secrets and package risk review"
  },
  {
   "name": "Credential setup planner",
   "url": "https://useaiblocks.com/skills/secrets-setup-helper",
   "why": "Credential setup planner"
  },
  {
   "name": "AI agent attack tester",
   "url": "https://useaiblocks.com/skills/ai-agent-attack-tester",
   "why": "AI agent attack tester"
  }
 ],
 "source": {
  "by": "Alireza Rezvani",
  "repo": "alirezarezvani/claude-skills",
  "url": "https://github.com/alirezarezvani/claude-skills/tree/main/engineering/skills/env-secrets-manager",
  "licence": "MIT",
  "original_name": "env-secrets-manager",
  "commit": "19392f7"
 },
 "credits": [
  {
   "title": "env-secrets-manager skill",
   "by": "Alireza Rezvani",
   "url": "https://github.com/alirezarezvani/claude-skills/tree/main/engineering/skills/env-secrets-manager",
   "used": "Copied under the MIT licence. We gave it a plain name and made the leak-response steps and scan scripts safe: no printing secrets to the terminal or logs, no secrets typed on command lines or sent to online search, a backup and approval before any history rewrite, and no claim that the scanner tracks rotation dates. We added Before you start and After this sections that link to other AI Blocks steps."
  }
 ],
 "files": [
  "LICENSE",
  "references/secret-patterns.md",
  "references/validation-detection-rotation.md",
  "scripts/env_auditor.py"
 ],
 "links": {
  "page": "https://useaiblocks.com/skills/secrets-hygiene-checker",
  "markdown": "https://useaiblocks.com/skills/secrets-hygiene-checker.md",
  "json": "https://useaiblocks.com/skills/secrets-hygiene-checker.json",
  "instructions": "https://useaiblocks.com/skills/secrets-hygiene-checker/SKILL.md",
  "download": "https://useaiblocks.com/skills/secrets-hygiene-checker.zip",
  "api_item": "https://useaiblocks.com/api/v1/items/secrets-hygiene-checker",
  "api_document": "https://useaiblocks.com/api/v1/documents/skill/secrets-hygiene-checker",
  "mcp": "https://useaiblocks.com/mcp"
 }
}