RepoAI
Browse MCPs

Hardcoded Secret Detection

100TrustedPre-approves tools

Identification of plain-text API keys and passwords in source code and configuration files.

What it does

Hardcoded Secret Detection transforms your assistant into a security-aware auditor for your repositories. By focusing on static assets like environment files, infrastructure templates, and application settings, it identifies credentials mistakenly left in plain text, ensuring they are flagged before they commit to version control or deployment workflows.

This skill provides a systematic approach for the assistant to probe common locations for sensitive data. It treats the discovery of unmasked, sensitive information as a high-risk event, prompting the assistant to categorize findings and suggest industry-standard remediation paths such as environment variables or secret managers.

When it earns its place

Reach for it when…

Apply this when performing manual or automated security reviews of a repository, specifically to verify that developers have not committed sensitive keys or database credentials to the codebase.

Look elsewhere when…

Do not rely on this for monitoring active systems or runtime traffic; it does not analyze memory dumps, logs, or encrypted data streams for dynamic token leakage.

What to say to use it

You never invoke a skill directly — the assistant picks it up when your request matches what it covers. These are the kinds of things that do that.

  • Check my config files for any accidentally exposed API keys
  • Scan this repository for hardcoded passwords or secrets
  • Identify any credentials found in my environment or terraform files
  • Are there any sensitive keys hidden in the current codebase?

Install it

Install for all your projects

Copy the skill directory into your personal skills folder. Claude picks it up on its own the next time your request matches what it does — there is nothing to enable.

bash
git clone --depth 1 --branch main https://github.com/Tencent/AI-Infra-Guard.git /tmp/AI-Infra-Guard
mkdir -p ~/.claude/skills
cp -r /tmp/AI-Infra-Guard/agent-scan/agent_scan/prompt/skills/hardcoded-secret-detection ~/.claude/skills/hardcoded-secret-detection

Install for one project only

Put it in the project's own skills folder instead, so it can be committed and shared with everyone working on that repository.

bash
cp -r /tmp/AI-Infra-Guard/agent-scan/agent_scan/prompt/skills/hardcoded-secret-detection .claude/skills/hardcoded-secret-detection

If a skill of the same name exists in both places, the personal one wins.

Installing on Claude.ai or through the API instead? The full guide covers every surface.

Pair it with an MCP server

Hardcoded Secret Detection changes how the work is done. These servers change what Claude can reach while doing it.

How skills and MCP servers differ →