Check Security

This documentation was generated with the assistance of AI. Please report any inaccuracies.

Scan the repository for accidentally committed secrets — API keys, passwords, tokens, private keys — using the detect-secrets CLI. This skill only scans and reports; it never removes, rotates, or edits a discovered secret, and never stages or commits the baseline file it may create.

Purpose

iru-check-security closes the gap between "code was reviewed for logic" and "code was checked for leaked credentials." For a whole-repository run it maintains a .secrets.baseline file so repeat runs only surface what changed — newly appeared findings, or ones still lacking a triage label — rather than re-alarming on already-audited, accepted false positives every time. For a scoped path it runs an ad hoc scan and reports every finding directly, with no baseline involved. It attempts to install detect-secrets itself if missing — first verifying its Python prerequisite is met (Linux/macOS ship Python already; on Windows it attempts to install Python via winget/choco first) — and if any prerequisite check or install method fails, lets the user choose whether to stop or continue without scanning rather than silently skipping the check.

Purpose group

Repository Maintenance

Invocation

/iru-check-security
/iru-check-security <path-or-glob>

Inputs

Argument Required Description Default

path-or-glob

No

Scopes the scan to specific files/directories, run ad hoc without touching .secrets.baseline. Every finding is reported regardless of whether it would otherwise be "known."

None — defaults to a whole-repository scan using the .secrets.baseline workflow, reporting only new or never-triaged findings.

Outputs

  • A plain-text report in the conversation — never a written file describing findings (though the baseline file itself may be created/updated on disk for whole-repository runs).

  • .secrets.baseline created (if absent) or updated in place (preserving prior audit labels) for a whole-repository run — never staged or committed by this skill.

  • Every finding needing attention: file path, line number, and secret type, grouped by file; for baseline runs, labeled as new or previously-flagged-but-unaudited. Entries already labeled is_secret: false are silently treated as confirmed false positives; entries labeled is_secret: true are mentioned only as a reminder they remain in the codebase.

  • A recommendation to remove/rotate a real secret, or run detect-secrets audit .secrets.baseline themselves — this skill never performs that triage labeling on the user’s behalf.

  • If detect-secrets couldn’t be installed: an explicit statement that no scan was performed, the real installation error, and the user’s choice of whether to stop or continue without scanning.

  • No source code, secret, or credential is ever modified, removed, or rotated by this skill.

Execution flow

flowchart TD A["Start /check-security\n(optional path-or-glob)"] --> B{detect-secrets\ninstalled?} B -- yes --> E B -- no --> P{Python\ninstalled?} P -- yes --> C["Try pip / pip3 / pipx install,\nthen brew on macOS"] P -- no --> W{Windows?} W -- "no (Linux/macOS)" --> D2["Warn: Python missing\n(unusual); ask stop or\ncontinue without scanning?"] D2 --> Z[Report: no scan performed] W -- yes --> WI["Attempt Python install:\nwinget, then choco"] WI -- succeeds --> C WI -- fails --> D3["Warn: Python could not be\ninstalled; ask stop or\ncontinue without scanning?"] D3 --> Z C -- all fail --> D["Warn user with real error;\nask: stop or continue without scanning?"] D --> Z C -- succeeds --> E{Argument given?} E -- yes --> F["Scoped ad hoc scan:\ndetect-secrets scan <path> --all-files"] E -- no --> G{.secrets.baseline exists?} G -- no --> H["Create it:\ndetect-secrets scan > .secrets.baseline\n(every finding is new)"] G -- yes --> I["Keep old contents; rescan with\ndetect-secrets scan --baseline ...;\ndiff old vs. new"] F --> J["Report every finding directly\n(no baseline involved)"] H --> K["Report all findings\n(freshly created baseline)"] I --> L["Report newly-appeared entries +\nentries still lacking a triage label;\nskip known true/false positives"]

Dependencies

Invokes

None — iru-check-security is a leaf skill; it only runs detect-secrets (and its own install attempts) and reports on the output, it does not call any other skill in this catalog.

Invoked by

  • Code — Steps 3 and 7, once per run (not per task), via its own general-purpose sub-agent, to capture a project-wide security baseline before implementation begins and compare the final state against it before archiving the plan. Any increase is treated as a hard stop, unlike the quality gate, since it risks committing a real credential.

Related agents

None directly — but iru-code (see Code and Agents) always invokes this skill from inside a general-purpose sub-agent it spawns, not inline.

Source

SKILL.md on GitHub — the file this page was generated from.