~/.claude/skills/secret-scanner/
├── SKILL.md              # 入口：frontmatter + 精简工作流
├── scripts/
│   └── scan.py           # 扫描引擎，输出 JSON 结果
├── templates/
│   └── report.md         # 报告模板
└── rules/
    ├── patterns.md       # 完整正则规则与误报处理（按需加载）
    └── remediation.md    # 各类密钥的轮换/撤销指引（按需加载）

mkdir -p ~/.claude/skills/secret-scanner/{scripts,templates,rules}

---
name: secret-scanner
description: Scans the codebase for hardcoded secrets, API keys, tokens and private keys, then writes a prioritized remediation report. Use when the user asks to check for leaked credentials, audit secrets/API keys, harden code before commit/push, or run a pre-commit security scan.
---

flowchart TD
    A[用户输入: '帮我查下有没有泄露的密钥'] --> B{匹配 description?}
    B -- 命中触发词 --> C[加载 SKILL.md 正文]
    B -- 未命中 --> D[不触发该技能]
    C --> E{正文引用脚本/规则?}
    E -- 是 --> F[按需读取 scripts/scan.py]
    E -- 否 --> G[直接按正文指令行动]
    F --> H[运行扫描并产出报告]

# 密钥泄露扫描

当用户请求扫描密钥 / 检查泄露凭证 / 审计安全时激活本技能。

## 工作流程
1. 运行扫描引擎：`python3 scripts/scan.py <目标目录>`（默认扫描当前目录）
2. 读取返回的 JSON 结果
3. 按严重度排序：私钥 > AWS/GitHub/Stripe 等高敏凭据 > 通用密钥
4. 用 `templates/report.md` 作为骨架，生成报告
5. 每条发现给出修复建议（迁移到环境变量 / 密钥管理服务 / 立即撤销轮换）

## 细节按需加载
- 完整正则规则与**误报处理策略**见 `rules/patterns.md`
- 各类密钥的**轮换与撤销指引**见 `rules/remediation.md`

## 输出与安全要求
- 报告写入项目根目录 `SECRET-SCAN-REPORT.md`
- **绝不**在报告里打印完整密钥明文，只显示前 6 位 + `***`
- 发现私钥或生产令牌时，在报告顶部用"🔴 紧急"标注并提醒立即撤销

#!/usr/bin/env python3
"""secret-scanner: 在代码库中扫描硬编码密钥，输出 JSON。"""
import re, sys, os, json

# (规则名, 正则, 严重度)
RULES = [
    ("Private Key Block",  r"-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----", "critical"),
    ("AWS Access Key",     r"AKIA[0-9A-Z]{16}", "high"),
    ("AWS Secret Key",     r"aws_secret_access_key\s*=\s*['\"][A-Za-z0-9/+=]{40}['\"]", "high"),
    ("GitHub Token",       r"gh[pousr]_[A-Za-z0-9]{36,}", "high"),
    ("Google API Key",     r"AIza[0-9A-Za-z_\-]{35}", "high"),
    ("Stripe Secret Key",  r"sk_live_[A-Za-z0-9]{24,}", "high"),
    ("Slack Token",        r"xox[baprs]-[A-Za-z0-9-]{10,}", "medium"),
    ("Generic Secret",     r"(?i)(password|passwd|pwd|secret|token|api[_-]?key)\s*[:=]\s*['\"][^'\"]{16,}['\"]", "medium"),
]

SKIP_DIRS = {"node_modules", ".git", "venv", ".venv", "__pycache__", "dist", "build"}
SCAN_EXT  = {".py", ".js", ".ts", ".go", ".java", ".rb", ".php",
             ".env", ".yml", ".yaml", ".json", ".sh", ".conf", ".ini", ".toml", ".tf"}

def scan(root):
    findings = []
    for dirpath, dirnames, files in os.walk(root):
        dirnames[:] = [d for d in dirnames if d not in SKIP_DIRS]   # 原地剪枝
        for f in files:
            if os.path.splitext(f)[1] not in SCAN_EXT:
                continue
            fp = os.path.join(dirpath, f)
            try:
                with open(fp, encoding="utf-8", errors="ignore") as fh:
                    for i, line in enumerate(fh, 1):
                        for name, pat, sev in RULES:
                            if re.search(pat, line):
                                findings.append({
                                    "file": fp, "line": i, "rule": name,
                                    "severity": sev,
                                    "snippet": line.strip()[:80],
                                })
            except OSError:
                pass
    findings.sort(key=lambda x: ["critical","high","medium"].index(x["severity"]))
    return findings

if __name__ == "__main__":
    target = sys.argv[1] if len(sys.argv) > 1 else "."
    print(json.dumps(scan(target), indent=2, ensure_ascii=False))

chmod +x ~/.claude/skills/secret-scanner/scripts/scan.py

# 密钥匹配规则与误报处理

## 已知误报
- 示例代码、文档、单测 fixture 里的假密钥（如 `AKIAIOSFODNN7EXAMPLE`）应忽略
- 环境变量**引用**（`os.getenv("AWS_KEY")`）不是泄露，只有**赋值字面量**才算

## 处理策略
- 若文件名含 `test/`、`example/`、`docs/` 或后缀 `.md`，降低严重度一档
- 对 Generic Secret 规则，先确认右侧是否为占位符（`your-key-here`、`xxx`），是则跳过

# 🔐 密钥泄露扫描报告

扫描时间：{{date}}　扫描目录：{{target}}
**发现 {{count}} 处疑似泄露**（🔴 紧急 {{critical}} / 🟠 高危 {{high}} / 🟡 中危 {{medium}}）

## 紧急处理清单
> 含私钥或生产令牌的项目，请立即在各服务商后台**撤销并轮换**对应凭证。

| 严重度 | 文件 | 行号 | 规则 | 片段（已脱敏） |
|--------|------|------|------|----------------|
{{rows}}

## 修复建议
- [ ] 将所有硬编码密钥迁移到环境变量或密钥管理服务（AWS Secrets Manager / Vault）
- [ ] 撤销已泄露的凭证并轮换
- [ ] 在 `.gitignore` 中加入 `.env`，并考虑接入 pre-commit 的密钥扫描钩子

mkdir -p /tmp/demo-app && cd /tmp/demo-app
cat > config.py <<'EOF'
AWS_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"
GITHUB_TOKEN   = "ghp_0123456789abcdef0123456789abcdef0123"
api_key = os.getenv("STRIPE_KEY")   # 这是引用，不应报
EOF
cat > id_rsa.bak <<'EOF'
-----BEGIN RSA PRIVATE KEY-----
fakecontent
-----END RSA PRIVATE KEY-----
EOF

python3 ~/.claude/skills/secret-scanner/scripts/scan.py /tmp/demo-app

[
  {
    "file": "/tmp/demo-app/id_rsa.bak",
    "line": 1,
    "rule": "Private Key Block",
    "severity": "critical",
    "snippet": "-----BEGIN RSA PRIVATE KEY-----"
  },
  {
    "file": "/tmp/demo-app/config.py",
    "line": 2,
    "rule": "GitHub Token",
    "severity": "high",
    "snippet": "GITHUB_TOKEN   = \"ghp_0123456789abcdef0123456789abcdef0123\""
  }
]

disable-model-invocation: true

allowed-tools: Bash(python3 scripts/scan.py:*), Read, Write(SECRET-SCAN-REPORT.md)

sequenceDiagram
    participant U as 用户
    participant C as Claude Code
    participant S as secret-scanner 技能
    participant P as scan.py
    U->>C: "扫描项目里的密钥"
    C->>S: description 命中，加载 SKILL.md
    S->>P: 运行 python3 scripts/scan.py .
    P-->>S: 返回 JSON 发现清单
    S->>S: 按模板脱敏 + 排序
    S-->>C: 写入 SECRET-SCAN-REPORT.md
    C-->>U: 报告摘要 + 修复建议