Plan Secrets Audit | Agent Skills Atlas

About this skill

Audit a codebase and git history for exposed credentials and mis-scoped keys, then produce a phased rotation-and-remediation plan. Use when the user says "check for hardcoded secrets", "are my API keys exposed", "did I commit a key", "secret scan", "is my .env safe", "rotate keys", or is hardening before launch or open-sourcing. Vibe-coded apps ship keys in client bundles; secrets committed once live in git history forever — ROTATE, not just relocate. Scans sk/pk/whsec/servicerole, separates safe-client (anon, publishable) from never-client (servicerole, secret), flags history needing rotation, checks NEXTPUBLIC exposure and Vercel/AWS env config. Plan only until approved. Pairs with plan-rls-audit. Do NOT use for RLS logic or input validation.

Quick start

Copy the install prompt. Use the green button above this README.
Send it to your agent. Paste it into your coding agent’s chat and send.
Review the setup. Your agent checks the skill’s instructions, requirements, and installation scope.

Installation guide →

Review, license & listing details

Review the source before using this skill

This is an imported listing. We haven’t certified its safety, license, or compatibility. Skills may include executable scripts.

Automated security scan: Partial

Only SKILL.md was scanned. Supporting files and scripts were not checked. No safety grade has been assigned.

0 potential findings · Scanned 11/4/2026 · Scanner 0.2.1

Content SHA-256: 9be759ddf48d301852299893be2a7e1e7490fda20febded192a18d794e0a80c1

About scan coverage and limitations

Original listing metadata

Original name

plan-secrets-audit

Original description

Audit a codebase and git history for exposed credentials and mis-scoped keys, then produce a phased rotation-and-remediation plan. Use when the user says "check for hardcoded secrets", "are my API keys exposed", "did I commit a key", "secret scan", "is my .env safe", "rotate keys", or is hardening before launch or open-sourcing. Vibe-coded apps ship keys in client bundles; secrets committed once live in git history forever — ROTATE, not just relocate. Scans sk_/pk_/whsec_/service_role, separates safe-client (anon, publishable) from never-client (service_role, secret), flags history needing rotation, checks NEXT_PUBLIC_ exposure and Vercel/AWS env config. Plan only until approved. Pairs with plan-rls-audit. Do NOT use for RLS logic or input validation.

About this listing

Category: Security
Reported license: MIT
Listing language (estimated): English
Review status: Not individually reviewed
Agent compatibility: Atlas installation supports Claude Code, Codex, and Cursor. Skill-specific dependencies and features are checked during setup.