Is Your GitHub Repo Leaking? · Must-Have Skills for Keys, Dependencies and Vulnerabilities

Hand the security sweep to your agent: scan secrets, audit dependencies, review code — 2 skills per job

Deep Skill Finder · Repo Security

Three hard truths before you scan anything

2.76M pages contain exposed credentials, 63% of keys are reused, and 1,500+ Mailchimp keys are hardcoded in JS — the model you use may be trained on leaked secrets.

GitHub · Secrets exposure thread

I pushed my API key to a public repo by accident. GitHub is not a safe — search engines index it faster than your boss reads it. Reset first, regret later.

Reddit · API key confession

444 iOS apps with LLM integrations were analyzed: 63.5% exposed exploitable API credentials in network traffic, and only 28% fixed it three months after responsible disclosure.

X · LLM key leak research

Real voices scattered across Reddit / Hacker News / X / dev forums — stitched together, this is what people go through when doing "GitHub repository security self-check".

Lazy path · recommended

Install deep-skill-finder once — let your Agent find Skills for you

Whatever "GitHub repository security self-check" task you have, MEYO already has the matching Skills. You don't need to hunt one by one — install deep-skill-finder and your Agent will auto-search MEYO's 50,000+ Skill library on every task, recommending the best match. You just say what you want to do — matching Skills is the Agent's job.

Copy → paste into Claude Code / Codex / Cursor / WorkBuddy / CatPaw · Agent installs automatically:

          Please install the deep-skill-finder skill: download the archive from https://www.meyo.life/skill-finder, extract it into your local skill directory and enable it.
        

Or browse common-scene Skills below. Learn more about deep-skill-finder → meyo.life/skill

Pick by risk type · 2 skills each for secrets, dependencies and vulnerabilities

Install them all, or just pick 1–2 by name. Don't worry about picking wrong — they're free, uninstall anytime.

Secret Leak Self-Check

Find hardcoded API keys, tokens and connection strings

For devs who just committed an AI API key

credential-scanner

40+ secret types, one pass

Scans files, repos and directories for leaked keys — API keys, tokens, passwords, connection strings, private keys and credentials, with severity-graded reports.

1439 users

secrets-audit

Includes git history

40+ regex patterns plus Shannon entropy filtering to cut false positives; checks deleted files and historical commits, groups findings by severity with fix advice.

704 users

Dependency CVE Audit

Known CVEs in your npm / pip dependency tree, in one sweep

For teams inheriting legacy projects before a launch

dep-audit

4-language CVE audit

Audits project dependencies for known vulnerabilities across npm, pip, Cargo and Go. No API key needed, safe by default: report-only mode.

1708 users

auditing-npm-dependencies

npm dependency-tree focus

Wraps npm audit JSON output to audit installed Node.js dependencies for known CVEs, reporting in a standard pentest structure.

2523 users

Code Vulnerability Review

Injection, XSS, hardcoded passwords and other OWASP anti-patterns

For business code with real security requirements

code-vuln-audit

All-in-one security scan

Covers dependency vulnerabilities, sensitive-information leakage (regex + entropy analysis) and OWASP anti-patterns like SQL injection, XSS and command injection.

4474 users

securityreview

Full source-code audit

Runs a comprehensive security audit on source code: hardcoded secrets, access-control flaws, injection risks and unsafe data handling.

2599 users

💬 Join the Deep Skill Finder Community

Trade "GitHub repository security self-check" workflows with other Deep Skill Finder users and get install help

QR code to join the Deep Skill Finder Discord community

FAQ

Q: I already pushed my key to GitHub. What now?

A: Reset the key at the provider immediately — leaked keys get scraped within seconds, so resetting beats deleting. Clean remote history afterwards if needed, then run credential-scanner across the repo to catch any second hardcoded copy.

Q: Do these skills modify my code?

A: No. They run in report-only mode: severity-graded findings and fix suggestions. You decide what to change.

Q: Can they scan git history for deleted keys?

A: secrets-audit checks git history and deleted files. If a key ever reached remote history, reset it first, then clean history with git filter-repo if necessary.

Q: Are they free?

A: Yes. All skills on the MEYO community are free; uninstall anytime. If you need install help, the Deep Skill Finder Discord community has you covered.

Q: I can't write regex. Can I add custom rules?

A: credential-scanner ships 40+ built-in key patterns covering AWS, GitHub, OpenAI and other major providers; ask your agent to append rules on top of the report for custom needs.

Q: Is this redundant with GitHub Secret Scanning?

A: They complement each other: platform-side scanning alerts after the fact, while local skills block leaks before commit and cover custom token formats GitHub doesn't know.