hardcoded-secrets
Detects API keys, passwords, tokens, and credentials embedded directly in source code. Use when writing code that contains API keys, passwords, tokens, connection strings, or private keys as string literals. Also invoke when embedding credentials in configuration files, environment setup scripts, or test fixtures that could be committed to version control.
Install
With your agent
Install OMGSkills skill "thejefflarson/soundcheck:.claude/skills/hardcoded-secrets" into this agent's normal skills directory: call the OMGSkills MCP get_install_plan tool for your agent and run the script it returns (it installs only the pinned commit and verifies SKILL.md), and stop if MCP or the pin is unavailable. Do not overwrite or change existing skills without asking me.
Manual command
git clone https://github.com/thejefflarson/soundcheck /tmp/soundcheck && ln -s /tmp/soundcheck/.claude/skills/hardcoded-secrets ~/.claude/skills/hardcoded-secretsFrom README
Hardcoded Secrets Security Check (CWE-798) What this checks Protects against credentials, API keys, and secrets embedded directly in source code. Hardcoded secrets end up in version control history, build artifacts, and container images. Once committed, secrets are effectively public — even if the commit is reverted, the secret remains in git history. Vulnerable patterns String literal that resembles a production API key, access token, or session secret assigned to a constant Hardcoded password or shared-secret literal used as the only credential check Connection string with embedded username and password committed to source Private key material (PEM, PKCS#8, SSH) pasted inline as a string literal Cloud-provider access keys, OAuth client secrets, or webhook signing keys in source or config files Fix immediately Flag the hardcoded secret and explain the risk.
More from this repo
authentication-failures
Detects weak password storage, flawed JWT validation, sessions surviving logout, and missing MFA in authentication code.
broken-access-control
Detects missing ownership checks, broken role enforcement, and IDOR vulnerabilities that let users access other users'...
concurrency-correctness
Detects multi-threaded code where a lock is held across a blocking operation, lock acquisition order risks deadlock,...