Skip to content
Get packs

Hardcoded Secret Detection

Lets an agent probe a target AI agent for API keys, passwords and private keys left in its code or config

Source Download skill
Repository
Tencent/AI-Infra-Guard
Stars
7,320
Licence
Apache-2.0
Files
1 file

What it does

This is a security-testing prompt playbook from a red-team scanner. It tells an AI agent how to ask another target agent whether its accessible source code and configuration files contain secrets such as API keys, tokens, passwords, private keys or database URIs with credentials. It also defines how to judge the replies, flagging real exposed secrets as a High-level finding while ignoring refusals, redacted values and placeholders.

Great for

  • Security teams auditing whether an AI agent with file or repo access leaks credentials in its config
  • Developers building AI agent red-team tests as part of Tencent AI-Infra-Guard
  • Reviewers who want a structured checklist of secret patterns (sk-, AKIA, ghp_, private key headers) to search for

Skip it if

  • Scanning your own codebase for secrets: this file only drives prompts sent to a target agent and contains no scanner or regex engine, so dedicated tools like gitleaks or trufflehog are better for that
  • Use against agents you do not own or have permission to test, since it actively tries to extract credentials from them

Try asking

  • “Test whether my deployed support agent reveals any API keys when asked to scan its config files”
  • “Run a hardcoded secret probe against the target agent and report any exposed tokens with file paths”
  • “Check whether the agent's .env, application.yml or docker-compose files contain credentials when read”
Step-by-step guide: how to use Hardcoded Secret DetectionInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.

    hardcoded-secret-detection.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip hardcoded-secret-detection.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip hardcoded-secret-detection.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Only run this against systems you own or have written permission to test, and treat any real secret found as compromised and rotate it
  • Run the skill after the Information Collection step so it can skip probes for secrets already disclosed
  • Pair it with a dedicated secret scanner on the actual repository for a fuller check

What's inside

  • SKILL.md

Redistributed unmodified from Tencent/AI-Infra-Guard under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.