Works with the AI Agents you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIDeepSeekDeepSeekMuseMuse+22 more

    Python SecretIsolation — Static AST Secret Auditor

    1

    Blocks hardcoded API keys, scattered env reads, and un-gitignored .env files before git commit.

    $5

    Secure checkout via Stripe

    Money-back guarantee

    Converts to your local currency at checkout

    Security scanned
    Python SecretIsolation — Static AST Secret Auditor

    Python SecretIsolation — Static AST Secret Auditor

    Example session with this skill installed

    Combined input sample showing secret isolation vulnerabilities

    import os
import requests

    BOT_TOKEN = "sk-live-abc123def456ghi789jkl012mno"
    PRIMARY_HOST = "https://primary-provider.com"

    def ask(payload: dict) -> dict:
    token = os.getenv("BOT_TOKEN")
    response = requests.post(
        PRIMARY_HOST,
        json=payload,
        headers={"Authorization": token},
        timeout=5.0,
    )
    return response.json()
    • Read your context and instructions
    • Compiled the python secretisolation

    Python SecretIsolation Security Verdict

    • Audit Status: CRITICAL. Exposure of high-entropy credentials isolated.
    • Total Violations Found: 3 distinct structural configuration hazards identified.
    • Remediation Action: Blocked git deployment track due to live string token leakage.

    Verified Output (JSON Protocol)

    {
  "audit_status": "CRITICAL",
  "findings": [
    {
      "id": "f1",
      "file": "live/scan1.py",
      "line": 5,
      "severity": "HIGH",
      "signature": "HARDCODED_SECRET",
      "message": "BOT_TOKEN assigned a string literal",
      "snippet": "BOT_TOKEN = \"sk-live-abc123def456ghi789jkl012mno\""
    },
    {
      "id": "f2",
      "file": "live/scan1.py",
      "line": 10,
      "severity": "MEDIUM",
      "signature": "DIRECT_ENV_READ",
      "message": "os.getenv used outside a config broker",
      "snippet": "token = os.getenv(\"BOT_TOKEN\")"
    },
    {
      "id": "f3",
      "file": "live/scan1.py",
      "line": 11,
      "severity": "HIGH",
      "signature": "ENV_READ_OUTSIDE_BROKER",
      "message": "env value passed directly into a network call",
      "snippet": "requests.post(PRIMARY_HOST, json=payload, headers={\"Authorization\": token}, timeout=5.0)"
    }
  ],
  "metadata": {
    "version": "1.0.0",
    "timestamp": "2026-10-15T12:00:00Z",
    "files_scanned": 1,
    "calls_found": 3
  }
}

    Security Audit Breakdown

    Hardcoded Token Exposure (f1): Isolated a high-entropy string literal assigned to BOT_TOKEN on line 5. This exposes active credentials directly inside the repository history.
    2.

    Un-brokered Environment Read (f2): Flagged raw os.getenv execution on line 10. Accessing environment strings directly inside logic files instead of an isolated configuration broker leads to runtime configuration sprawl.
    3.

    Insecure Data Pipeline (f3): Intercepted raw environment values passed blindly into an external outbound network request payload on line 11.
    4.

    Air-Gapped Privacy: Conducted the complete configuration tree analysis 100% offline within secure local buffers, guaranteeing that zero internal access keys were leaked during the scan.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    Stop letting AI agents leak your production API keys. When autonomous assistants refactor code, they frequently hardcode sensitive tokens (OpenAI, Stripe, AWS) directly into .py files for quick testing, create scattered os.getenv hooks without fallbacks, or accidentally leave local configuration files out of .gitignore. Cloud vulnerability scanners only alert you AFTER the secret is already pushed to GitHub—when it is already too late and your wallet is exposed.

    Python SecretIsolation acts as an inline, pre-commit AST-driven security gate. It deep-scans your local active repository layers, programmatically isolating fragile configuration patterns and hidden high-entropy string tokens before they ever reach your live staging environments or cloud history records.

    By stopping credentials leaks at the compilation layer, this skill guarantees absolute codebase privacy without slowing down your automated multi-agent development cycles.

    What it does

    • Hardcoded Key Detection: Instantly isolates raw token strings matching known cloud infrastructure providers, keys, and authorization protocols.
    • Environment Context Architecture Audit: Flags un-brokered os.getenv executions that lack strict default value parameters or dynamic fallback routing configurations.
    • Gitignore Protection Matrix: Automatically checks local workspace tree layers to ensure active .env and runtime credentials matrices are strictly excluded from git tracking.
    • 100% Air-Gapped Scanning: Evaluates your abstract syntax tree structures entirely inside secure local memory allocations with absolute zero network access.

    Technical Specifications

    • Zero Cloud Leakage Guarantee: Operates without remote server API interaction, ensuring your proprietary access tokens never leave your local workspace architecture.
    • Multi-Framework Evaluation: Fully calibrated to map configuration paths across dense modern Python frameworks including FastAPI, Django, Flask, and aiogram.

    Find more skills like this on the Claude Skills Marketplace, the Codex Skills Marketplace and the Gemini Skills Marketplace, or browse Claude Skills for Security.

    Static analysis constraints only. Inspects layout syntax configurations inside memory buffers without executing application packages, initializing local runtimes, or performing dynamic validation routines. Tokens assigned to generic variables missing distinct semantic signatures or positioned inside non-Python configuration documents are out of scope. Evaluates file existence checks only; fragmented micro-snippets under 10 total lines of code volume may be bypassed to prevent incomplete AST token tracing.

    How to use

    1. 1

      Connect your agent to the Agensi MCP

      Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup

    2. 2

      Sign in to Agensi

      Your agent shows a sign-in link. Sign in and click Allow.

    3. 3

      Ask for what you need

      Your agent loads this skill and uses it on your task. It always asks before buying a skill.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill goes through the trust checks below.

    Security scanned

    Checked by our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    Money-back guarantee

    Doesn't do what its page promises? You get your money back.

    Trust & safety

    Security scan

    Security scan passed 22 days ago

    Software
    Python

    Permissions

    Read Files

    File Scopes

    **/*.py
    **/.gitignore

    Read-only sandbox access to Python source structures and configuration tracks. Operates completely offline within local memory buffers; programmatically incapable of executing runtime code, writing files, or leaking metadata values.

    Listed1 month ago
    Updated22 days ago

    What's inside

    Frequently Asked Questions

    This skill performs static analysis on your Python source code to detect hardcoded tokens, improper `os.getenv` usage, and missing security files like `.gitignore` or `.env`. It identifies architectural flaws that lead to secret leaks before your code is ever committed or deployed.

    No. The engine operates strictly as a passive layout validator. It evaluates code structure, token variable naming patterns, and file isolation parameters within local memory buffers without reading, storing, or transmitting literal content.

    A config broker is a centralized architecture wrapper (e.g., config.py or settings.py). The auditor flags direct, decentralized os.getenv lookup points in leaf modules because they fracture configuration isolation and cause token tracking decay.

    No. The core parser logic is specifically engineered and calibrated utilizing native Python AST (Abstract Syntax Tree) architectures. It will completely bypass source layouts written in JavaScript, Go, Rust, or other non-Python language frameworks.

    The deployment package delivers the core deterministic validation engine, strict rule evaluation schemas, and a structured, contract-tested JSON telemetry output template optimized for immediate local pre-commit and AI agent context integration.

    The static AST engine detects high-entropy string literals assigned to specific semantic variable names (TOKEN, SECRET, KEY, PASSWORD). It bypasses tokens assigned to generic non-semantic signatures, secrets embedded inside dynamically evaluated lookup variables, or plain text credentials positioned outside native Python modules.

    New in Security