---
name: secrets-scanner
description: "Detects leaked secrets and credentials in messages"
metadata: { "openclaw": { "emoji": "🔑", "events": ["message:sent", "message:received"] } }
---
# Secrets Scanner

Scans all inbound and outbound messages for leaked API keys, tokens, and credentials using 20+ regex patterns.

## Detected Patterns

- OpenAI API keys (`sk-...`)
- Anthropic API keys (`sk-ant-...`)
- GitHub PATs and OAuth tokens (`ghp_`, `gho_`, `ghu_`)
- AWS Access Keys (`AKIA...`) and Secret Keys
- Google API Keys (`AIza...`)
- Stripe keys (`sk_live_`, `pk_live_`)
- Slack tokens and webhooks
- JWT tokens
- Private keys (RSA, EC, OPENSSH, PGP, DSA)
- Telegram, Discord, Vercel, npm, Twilio, SendGrid, Heroku tokens
- Generic API key patterns

## Events

| Event | Action |
|-------|--------|
| `message:received` | Scans user messages for accidentally shared secrets |
| `message:sent` | Scans AI responses for credentials that should not be echoed |

## On Detection

When a secret is found, the hook pushes a warning message to the user advising them to rotate the exposed credential immediately.