Secret Scanner
Scans a code directory before commit or release for suspected access keys / secret keys, private key headers, hardcoded tokens and database connection strings. Besides the working tree it can scan Git history (--git-history) and the staging area (--staged), useful for cleaning up credentials already committed or about to be. Reports file, line and a masked sample, never the raw value. Exclusion paths and rule-type filtering are supported.
secret-scanner-skillCapabilities
Specifications
secret-scanner-skillHow to install
Skill packages follow the open Agent Skills standard (one directory plus a SKILL.md). No request or licence is needed. Pick whichever path matches your client, then just describe the task in chat to trigger it.
① Import the package
RecommendedDownload the skill zip and load it from your client's "import / upload local skill package" entry. If SKILL.md sits at the top level of the archive, the package is well formed.
v1.0.0② Command line
For command-line clients that support the Agent Skills standard: one command syncs the skill into your local skills directory.
npx skills add m9ai/m9ai-skills --skill secret-scanner-skillPass -a to name the client (claude-code, codex); omit it and you will be asked which one to use.
③ Unzip manually
You can also unzip the archive straight into your client's skills directory - no installer to run. The zip is self-contained and can be distributed offline, which makes it easy to host on an internal file server for company-wide rollout.
Settings → Skills directory (as shown in the client)~/.claude/skills/.claude/skills/Other clients supporting the Agent Skills standard work the same way: drop the skill directory into their skills folder.
Need this inside your own systems?
Ready-made skills cover generic scenarios. Internal data sources, private models and compliance requirements call for a tailored build.