---
title: "scan-secrets"
description: "Blocks credentials: vendor tokens (AWS, GitHub, GitLab, Slack, OpenAI, HF,...), JWTs, private-key and PGP blocks, named key/token/secret/password values (JSON, YAML, env, HCL, code), URI creds, Authorization literals, CL"
canonical: https://agentpluginsdirectory.com/plugins/scan-secrets
last-updated: 2026-10-21
---

# scan-secrets
Blocks credentials: vendor tokens (AWS, GitHub, GitLab, Slack, OpenAI, HF,...), JWTs, private-key and PGP blocks, named key/token/secret/password values (JSON, YAML, env, HCL, code), URI creds, Authorization literals, CLI password flags; files by path (.env*, keys). Misses: split or encoded values, quoted values with spaces, unlisted names, reference- or placeholder-like values. Runs: commit, agent write, turn end. Pragma same line; agent: only if in HEAD; MCP gateway: never.
- Slug: scan-secrets
- Publisher: chock-core
- Repository: https://github.com/open-coder-ai/chock-catalog
- Manifest: .agents/policies/scan-secrets/plugin.json
- Version: 0.1.2
- License: Apache-2.0
- Category (editorial): security
- Skills: 1 (scan-secrets)
- MCP servers: 0
- Stars: 3
- Repository created: 2026-08-17
- Repository last pushed: 2026-10-21
- Publisher type: Organization
- Listing: https://agentpluginsdirectory.com/plugins/scan-secrets
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json

## Skills

- scan-secrets: Blocks known credential patterns, vendor key prefixes, private-key blocks, and key/token/password assignments, at two enforcement points: at commit (the git hook, over staged changes) and at agent tool-use (the mcp-gateway / agent write guard, over a tool call's arguments), so a secret is caugh…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.