secret-scanning: Claude Code Skill & Agent Tool
An open-source skill by github (opens in a new tab), published in the github/awesome-copilot (opens in a new tab) repository on GitHub. Configures GitHub secret scanning and push protection, defines custom patterns, triages alerts and lets your agent check code for secrets before it commits.
Install secret-scanning
Requires Node.jsnpx skills add github/awesome-copilot --skill secret-scanningRun this command in your project terminal to install this skill for Claude Code.
What this skill does
secret-scanning is a guide your agent follows to configure and manage GitHub secret scanning end to end. It explains how detection works and where it is available, then walks through enabling Secret Protection, turning on push protection so commits containing credentials are blocked before they reach the repository, configuring path exclusions, and switching on optional extra detection features.
When a push is blocked, the skill gives the agent three clear paths: remove the secret — amending the last commit, or rewriting history with an interactive rebase when the secret is older — bypass push protection with a documented reason, or request bypass privileges. It also covers custom patterns for your organization's own token formats, their scopes, and assisted pattern generation.
For alerts, the agent learns the alert types and lists, a clear remediation priority — rotate the credential immediately, then review the alert, check whether the secret is still active and clean history only if needed — and how to dismiss an alert properly. For checking code inside an AI coding agent before it commits, the skill points to GitHub's Advanced Security plugin. Use it with Claude Code to lock down a repository after a leaked key.
Key Capabilities
- Enables Secret Protection and push protection step by step
- Three ways to resolve a blocked push: remove, bypass with a reason, or request bypass
- Custom patterns for your own token formats
- Alert triage: rotate first, check validity, then clean history only if needed
- Points to GitHub's Advanced Security plugin for pre-commit checks in coding agents
How to use with Claude Code & AI Agents
Install the skill
Run the command above at the root of your project. The CLI asks which agents to set up — Claude Code, Cursor and other supported agents — and adds secret-scanning to the project, so teammates who pull the repository get it too. Add-gto install it for your user account across every project.Open a new agent session
Start a fresh Claude Code session in that project so the agent loads the new skill. Have ready: A GitHub repository where secret scanning is available.Ask in plain words
Describe the task, for example:“Enable secret scanning and push protection on this repository and add a custom pattern for our API tokens.”The agent matches your request to the skill's description and follows its SKILL.md instructions step by step. Read them on GitHub before using the skill on a system that matters.