Secret Scan
SkillFiles & storageCatch hardcoded secrets, keys, and tokens before they get committed. Use before any commit and on any file with credentials.
Available today. Use it from your connected AI after setup.
No other account needed.
Connect ahel once, and every AI you use reads what you have installed.
Then ask your AI: use the Secret Scan skill
What this skill tells your AI
The instructions your AI receives, as published by archive228/loopkit in skills/secret-scan/SKILL.md and read by ahel’s review.
Grep the diff for: api[_-]?key, secret, token, password, BEGIN PRIVATE KEY, AKIA[0-9A-Z]{16}, sk-, ghp_, bearer values, and long base64/hex blobs.
For each hit: is it a real secret or a placeholder? Real secrets:
- Must move to env / a secrets manager — never the repo.
- If already committed, it is COMPROMISED. Rotate it, don't just delete the line.
- Add the pattern to
.gitignore/ a pre-commit secret scanner. Output: file:line of every real secret + the rotation step. A deleted secret in git history is still leaked.
Signals
- GitHub stars
- 754
- Forks
- 126
- Last commit
- Jul 2026
Advanced
- Catalog kind
- skill
- Gateway key
secret-scan- Source
- github.com/archive228/loopkit