# AI Secret Scanner

> Scans authorized web apps for exposed AI and cloud API keys in client-delivered HTML and JavaScript.

- Type: Skill
- Author: Sapan Dhora, Rajesh Guttikonda, Madhusudahan Mergu
- License: MIT
- Trust tier: contributed (passed automated validation and a baseline maintainer review)
- Source repository: https://github.com/SDSicuritech/TenableAITokenSearch
- Repo state: not archived
- Last push: 2026-08-06T02:34:15Z
- Stars: 1 (a popularity signal, not a safety signal)
- Forks: 0 (a popularity signal, not a safety signal)
- Open issues: 0
- Language: Python
- Health checked at: 2026-11-05T20:35:15.821Z
- Integrations: Anthropic, AWS
- Domains: application-security, data-security
- Tags: secrets-detection, api-keys, appsec, exposure-management, vulnerability-assessment
- Date added: 2026-08-05
- Compatible platforms: Claude Code
- Invocation: `/ai-secret-scanner`
- Listing page: https://exchange.tenable.com/skills/ai-secret-scanner
- Source file: https://github.com/tenable/cyberagents-exchange/blob/main/skills/ai-secret-scanner.md

Front-end code routinely ships provider credentials to the browser. This skill
finds those exposures across assets you own and reports them in a form that is
safe to store and act on.

## What it does

Fetches each authorized target's HTML and linked JavaScript, then matches
credential shapes for OpenAI, Anthropic, Google/Gemini, Hugging Face, AWS access
key IDs, Stripe live keys, GitHub tokens, Slack bot tokens, JWTs, and generic
`api_key = "..."` assignments. Results land in a spreadsheet with source asset,
key type, masked value, fingerprint, and a remediation note.

## How it works

Scanning is gated on an explicit `--scope` host allowlist — the skill refuses to
run without one and skips any target or linked script outside it. Findings are
never written in plaintext: each becomes a short non-sensitive prefix, a
length-preserving mask (`sk-ant******(len=53)`), and a truncated SHA-256
fingerprint that lets you correlate the same leaked key across assets. TLS
verification stays on unless explicitly disabled. Detection only — it offers no
way to test whether a discovered key is live.

This is the Markdown version of one of 140 listings on CyberAgents Exchange. The same listing as JSON: https://exchange.tenable.com/api/skills/ai-secret-scanner.json. The full index and how to read it: https://exchange.tenable.com/llms.txt