Secret Shield

Hardcode security into your workflow by catching secrets before they leave your machine. This skill provides a systematic scanning and redaction process for text at the boundary, whether you are about to paste a log into an LLM chat, commit a config file, or share a stack trace in a support ticket. It moves beyond simple regex by combining pattern matching for known provider keys with entropy analysis to catch unlabelled tokens.

What it does

• Multi-layer scanning uses both pattern-based rules for 20+ providers and Shannon entropy for unlabelled keys.
• Contextual redaction replaces identified secrets with named placeholders like [REDACTED:AWS_ACCESS_KEY_ID] to maintain diagnostic utility.
• Boundary protection targets the exact artifact leaving the machine, such as staged diffs, clipboard content, or log fragments.
• Confidence scoring distinguishes between high-signal rule matches and lower-confidence entropy findings.
• Audit logging records findings using value fingerprints (hashes) to track leaks without storing raw secrets.

How it works

1. Trigger a scan on a specific file, staged diff, or piped text using commands like "scan for secrets" or "sanitize this log".
2. Review findings in "Observe" mode to see masked previews and rule matches without altering the source.
3. Execute redaction to generate a clean version of the text with specific placeholders replacing sensitive strings.
4. Update the allowlist for known-safe high-entropy strings or test keys to reduce false positives in future runs.

Frameworks & tools

The skill utilizes a local Python scanning script and a library of regex patterns covering AWS, Google Cloud, Azure, GitHub, OpenAI, Stripe, and database connection strings.

Why this beats prompting it yourself

Standard prompts often hallucinate secret boundaries or miss unlabelled high-entropy strings entirely. This skill implements a rigorous two-pass method (pattern then entropy) and uses a consistent placeholder system that ensures redacted logs remain readable for debugging.

Use cases

• Pre-commit checks to prevent live .env values or cloud keys from entering git history.
• Log sanitization before pasting error dumps into LLM chats or public issues.
• Config sharing to safely send redacted settings.json or docker-compose.yml files to teammates.
• Leak recovery to identify the scope of a suspected compromise and facilitate rotation.

Known limitations

Does not scan entire repositories at once; it focuses on specific artifacts at the boundary. Large files are scanned in head/tail windows, potentially skipping the middle if not chunked.