Skip to content

Commit 6fe19e8

Browse files
patnikopatniko
authored
Merge pull request #28 from github/ghas-plugin
Add GHAS plugin
2 parents 944b6d8 + a71ffb6 commit 6fe19e8

3 files changed

Lines changed: 226 additions & 0 deletions

File tree

‎.github/plugin/marketplace.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,15 @@
2626
"skills": [
2727
"./skills/spark"
2828
]
29+
},
30+
{
31+
"name": "advanced-security",
32+
"source": "./plugins/advanced-security",
33+
"description": "Advanced Security plugin for GitHub Copilot.",
34+
"version": "1.0.0",
35+
"skills": [
36+
"./skills/secret-scanning"
37+
]
2938
}
3039
]
3140
}

‎plugins/advanced-security/README.md‎

Lines changed: 17 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,17 @@
1+
# Advanced Security
2+
3+
Security-focused plugin that brings GitHub Advanced Security capabilities into AI coding workflows through skills and MCP integrations.
4+
5+
## What it does
6+
7+
Advanced Security helps agents identify and prevent credential exposure during development by:
8+
9+
- Scanning code snippets, files, and git changes for potential secrets
10+
- Using GitHub secret detection patterns through MCP tooling
11+
- Supporting pre-commit checks to catch leaked credentials early
12+
13+
## Skills
14+
15+
### `secret-scanning`
16+
17+
Activated when a user asks to check code, files, or git changes for exposed credentials. Uses the `run_secret_scanning` MCP tool to scan content for potential secrets before code is committed.

‎plugins/advanced-security/skills/secret-scanning/SKILL.md‎

Lines changed: 200 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,200 @@
1+
---
2+
name: secret-scanning
3+
description: Scan files, content, or recent changes for secrets such as API keys, passwords, tokens, and credentials using the GitHub MCP Server's run_secret_scanning tool.
4+
metadata:
5+
agents:
6+
supported:
7+
- GitHub Copilot Coding Agent
8+
- Cursor
9+
- Codex
10+
- Claude Code
11+
requires:
12+
mcp_server: github
13+
mcp_tool: run_secret_scanning
14+
allowed-tools: Bash(git:*) Glob Grep Read
15+
---
16+
17+
# Secret Scanning Skill
18+
19+
## Overview
20+
21+
This skill uses the GitHub MCP Server's `run_secret_scanning` tool to detect secrets in content, files, or git changes. It helps identify sensitive material like API keys, passwords, and credentials that could pose a security risk if exposed.
22+
23+
### What counts as a secret?
24+
25+
In this context, values that grant access, impersonate a user or service, sign requests, or decrypt protected data are generally treated as secrets.
26+
27+
Treat these as high-confidence secret material:
28+
29+
- Access tokens, API keys, and bearer credentials
30+
- Passwords, database DSNs with embedded credentials, and SMTP auth values
31+
- Private keys, signing keys, certificates with private key blocks, and SSH keys
32+
- OAuth client secrets, refresh tokens, and webhook secrets
33+
- Cloud credentials (AWS/GCP/Azure) and CI/CD deployment credentials
34+
35+
Prefer context, not just regex:
36+
37+
- Values near names like `password`, `token`, `secret`, `client_secret`, `private_key`, or `authorization` are higher risk
38+
- Long high-entropy strings in config files, scripts, and test fixtures deserve review even if unlabeled
39+
- Treat uncertain findings as sensitive until verified
40+
41+
Not everything that looks random is a secret. Example placeholders such as `YOUR_API_KEY_HERE`, obvious test stubs, and documented sample values can be false positives.
42+
43+
### Why this is important
44+
45+
This skill scans for secrets that could compromise security if leaked. A committed secret can persist in git history, trigger incident response, and block deployment at push protection checks.
46+
47+
**Important**: Only use this skill when a user explicitly asks to scan content or check for secrets. Do not run secret scanning unprompted or as part of general workflows.
48+
49+
## Common Scenarios
50+
51+
| User goal | How to respond | Tools needed |
52+
| -------------------------------------- | -------------------- | ------------------ |
53+
| Check a config snippet or code paste | Scan as content | MCP |
54+
| Check a specific file in the repo | Read file, then scan | Read + MCP |
55+
| Check all staged changes before commit | Get diff, then scan | Bash(git:\*) + MCP |
56+
57+
## Installation
58+
59+
### Prerequisites & Inputs
60+
61+
**GitHub MCP Server**: The skill requires the GitHub MCP Server with the `run_secret_scanning` tool enabled.
62+
63+
Configure in your MCP settings:
64+
65+
```json
66+
{
67+
"mcpServers": {
68+
"github": {
69+
"type": "http",
70+
"url": "https://api.githubcopilot.com/mcp/"
71+
}
72+
}
73+
}
74+
```
75+
76+
> **Note:** Cursor uses `servers` instead of `mcpServers` as the top-level key.
77+
78+
**Required information for scanning**:
79+
80+
- **Repository owner**: Usually available from `git remote get-url origin` or ask the user
81+
- **Repository name**: Usually available from `git remote get-url origin` or ask the user
82+
- **Content to scan**: Either a code snippet from the user, file content (read using the `Read` tool), or git diff output (from `git diff`)
83+
84+
If the user doesn't provide repository owner and repository name, ask for them before running the scan.
85+
86+
**What NOT to scan**: By default, avoid scanning large generated or vendor content (for example: `node_modules/`, build artifacts, compiled assets, or other machine-generated files) for performance and noise reduction. Files listed in `.gitignore` may still contain secrets (such as `.env` or local config), so only skip them if the user agrees; if the user explicitly asks to scan them, include them in the scan.
87+
88+
### Scan Content
89+
90+
**When to use**: The user provides text or code snippets they want checked for secrets.
91+
92+
**How**: Use the `run_secret_scanning` tool with the content as input (as a single-item array).
93+
94+
**Example**
95+
96+
```
97+
You: Check if this config snippet has secrets
98+
User provides:
99+
DB_PASSWORD=MyP@ssw0rd123
100+
API_KEY=abc123xyz
101+
102+
Agent: I'll scan that for secrets.
103+
104+
⚠️ Found 2 potential secret(s):
105+
1. DB_PASSWORD value looks like a password
106+
2. API_KEY value looks like an API key
107+
108+
Consider replacing hardcoded values with environment variables.
109+
```
110+
111+
### Scan File(s)
112+
113+
**When to use**: The user asks to check specific files in the repository for secrets.
114+
115+
**How**: Use the `Read` tool to get file contents, then pass them to `run_secret_scanning`.
116+
117+
**Example (secrets found)**
118+
119+
```
120+
You: Check if config.py has secrets
121+
Agent: I'll read and scan that file.
122+
123+
⚠️ Found 1 potential secret:
124+
- Line 10: database_password value looks like a password
125+
126+
Suggestion: Move to environment variable or .env file.
127+
```
128+
129+
**Example (no secrets found)**
130+
131+
```
132+
You: Check if utils.js has any secrets
133+
Agent: I'll read and scan that file.
134+
135+
✅ No secrets detected in utils.js
136+
```
137+
138+
### Scan Staged Changes
139+
140+
**When to use**: The user wants to check git staged changes for secrets before committing.
141+
142+
**How**: Use `git diff --cached` to get staged content, then pass it to `run_secret_scanning`.
143+
144+
**Example (clean)**
145+
146+
```
147+
You: Check my staged changes for secrets before I commit
148+
Agent: I'll scan your staged changes.
149+
150+
✅ No secrets found in staged changes. Safe to commit.
151+
```
152+
153+
**Example (secrets detected)**
154+
155+
```
156+
You: Scan my staged changes
157+
Agent: I'll check your staged changes.
158+
159+
⚠️ Found 1 potential secret in staged changes:
160+
- database.js line 5: password value looks like a credential
161+
162+
Suggestion: Unstage that change, move the credential to env vars, and restage.
163+
```
164+
165+
## How the Scan Works
166+
167+
When you call `run_secret_scanning`:
168+
169+
- **Input**: File contents to scan (passed as an array of strings), plus repository owner and name
170+
- **Process**: GitHub's secret detection scans for patterns and context that match known secret types
171+
- **Output**: List of potential secrets found with locations and confidence indicators
172+
173+
The tool works on content you provide. It doesn't need push access or special GitHub permissions.
174+
175+
## Scanning Transparency
176+
177+
### How Your Content Is Processed
178+
179+
When you request a scan, file contents are sent to GitHub's secret detection infrastructure. The scanning happens server-side against GitHub's known secret patterns. Scan results are returned without retaining the content on GitHub servers beyond the scan request.
180+
181+
### What to Do With Results
182+
183+
If secrets are found:
184+
185+
- **Obvious hardcoded values**: Move them to environment variables or `.env` files
186+
- **Config files**: Check if `example.env` or documentation exists that shows the expected structure
187+
- **Already committed**: If the secret was already pushed, credential rotation may be needed (outside this skill's scope)
188+
189+
If no secrets are found:
190+
191+
- The scan completed successfully
192+
- Check the output format in the scan result to make sure coverage was complete
193+
194+
## Learn More
195+
196+
For more details on secret scanning, credential management, and GitHub security features:
197+
198+
- [GitHub Secret Scanning Docs](https://docs.github.com/en/code-security/secret-scanning): How to enable and use secret scanning on repositories
199+
- [Credential Management Best Practices](https://docs.github.com/en/code-security/secret-scanning/about-secret-scanning): Guidance on handling credentials safely
200+
- [GitHub Push Protection](https://docs.github.com/en/code-security/secret-scanning/working-with-push-protection): Preventing secrets from reaching your repository

0 commit comments

Comments
 (0)