SD-006 — Hardcoded Secret
SD-006 flags credential-shaped literals in supported files, including AWS access keys, GitHub and Slack tokens, sk- API keys and generic secret assignments.
What it matches
Credential-shaped literals in supported files: AWS access keys, GitHub and Slack tokens, sk- API keys, or long values assigned to secret-shaped names.
Why it matters
A real credential stored in a submitted repository or skill can spread through clones, forks and caches, and may remain in version history after the line is deleted. This rule matches credential shapes only; it does not establish that the value is committed, valid or live.
Example
yaml
# In the skill's committed config: api_key: "sk-EXAMPLEEXAMPLEEXAMPLEEXAMPLEEXAMPLE" aws_access_key_id: AKIAEXAMPLEEXAMPLE12
Placeholders here; in a real skill this is the credential itself, committed.
How to fix it
Read the value from the environment or a secrets manager at run time and keep only the variable name in the file. If a real key has already been committed, rotate it first and remove it second — it survives in the repository's history and in every clone taken before the removal.
Known false positives
Placeholder and example keys. We do not verify a secret is live, because verifying would mean using it.
Standards mapping
Prevalence
Pattern SD-006 was detected in 94 of 16996 public skills scanned as of 27 October 2026.
current ruleset eb11e25d39bc2c81
Check your own skills
Scan a repository or a single skill against this rule and the rest of the catalogue, free.