Skip to content

Extend secret-scanning skill with MCP pre-commit scanning support #1154

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
felickz wants to merge 11 commits into from
Closed

Extend secret-scanning skill with MCP pre-commit scanning support #1154

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
19f43b1
chore: publish from staged
github-actions[bot] Mar 19, 2026
faf90f6
Initial plan
Copilot Mar 19, 2026
795aa7b
Update secret-scanning skill with MCP pre-commit scanning support
Copilot Mar 19, 2026
bc0a9bb
feat: add MCP pre-commit secret scanning to secret-scanning skill
Copilot Mar 19, 2026
fa25e2f
Merge remote-tracking branch: resolve conflicts keeping best of both …
Copilot Mar 19, 2026
3c5a5cd
Initial plan
Copilot Mar 19, 2026
8ffda58
Reference Advanced Security plugin for MCP pre-commit scanning in sec…
Copilot Mar 19, 2026
8901630
Merge pull request #2 from forks-felickz/copilot/copilotrevise-secret…
felickz Mar 19, 2026
963c3f4
Remove verbose "When to use which" table from secret-scanning SKILL.md
Copilot Mar 19, 2026
e26336b
Merge pull request #1 from forks-felickz/copilot/update-secret-scanni…
felickz Mar 24, 2026
b659c32
Merge remote-tracking branch 'upstream/main'
felickz Mar 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion docs/README.skills.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -232,7 +232,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to
| [sandbox-npm-install](../skills/sandbox-npm-install/SKILL.md) | Install npm packages in a Docker sandbox environment. Use this skill whenever you need to install, reinstall, or update node_modules inside a container where the workspace is mounted via virtiofs. Native binaries (esbuild, lightningcss, rollup) crash on virtiofs, so packages must be installed on the local ext4 filesystem and symlinked back. | `scripts/install.sh` |
| [scaffolding-oracle-to-postgres-migration-test-project](../skills/scaffolding-oracle-to-postgres-migration-test-project/SKILL.md) | Scaffolds an xUnit integration test project for validating Oracle-to-PostgreSQL database migration behavior in .NET solutions. Creates the test project, transaction-rollback base class, and seed data manager. Use when setting up test infrastructure before writing migration integration tests, or when a test project is needed for Oracle-to-PostgreSQL validation. | None |
| [scoutqa-test](../skills/scoutqa-test/SKILL.md) | This skill should be used when the user asks to "test this website", "run exploratory testing", "check for accessibility issues", "verify the login flow works", "find bugs on this page", or requests automated QA testing. Triggers on web application testing scenarios including smoke tests, accessibility audits, e-commerce flows, and user flow validation using ScoutQA CLI. Use this skill proactively after implementing web application features to verify they work correctly. | None |
| [secret-scanning](../skills/secret-scanning/SKILL.md) | Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. This skill should be used when users need help enabling secret scanning, setting up push protection, defining custom secret patterns, triaging secret scanning alerts, or resolving blocked pushes. | `references/alerts-and-remediation.md`<br />`references/custom-patterns.md`<br />`references/push-protection.md` |
| [secret-scanning](../skills/secret-scanning/SKILL.md) | Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing. | `references/alerts-and-remediation.md`<br />`references/custom-patterns.md`<br />`references/push-protection.md` |
| [semantic-kernel](../skills/semantic-kernel/SKILL.md) | Create, update, refactor, explain, or review Semantic Kernel solutions using shared guidance plus language-specific references for .NET and Python. | `references/dotnet.md`<br />`references/python.md` |
| [shuffle-json-data](../skills/shuffle-json-data/SKILL.md) | Shuffle repetitive JSON objects safely by validating schema consistency before randomising entries. | None |
| [snowflake-semanticview](../skills/snowflake-semanticview/SKILL.md) | Create, alter, and validate Snowflake semantic views using Snowflake CLI (snow). Use when asked to build or troubleshoot semantic views/semantic layer definitions with CREATE/ALTER SEMANTIC VIEW, to validate semantic-view DDL against Snowflake via CLI, or to guide Snowflake CLI installation and connection setup. | None |
Expand Down
20 changes: 19 additions & 1 deletion skills/secret-scanning/SKILL.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
---
name: secret-scanning
description: Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. This skill should be used when users need help enabling secret scanning, setting up push protection, defining custom secret patterns, triaging secret scanning alerts, or resolving blocked pushes.
description: 'Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret scanning in AI coding agents via the GitHub MCP Server, this skill references the Advanced Security plugin (`advanced-security@copilot-plugins`). Use this skill when enabling secret scanning, setting up push protection, defining custom patterns, triaging alerts, resolving blocked pushes, or when an agent needs to scan code for secrets before committing.'
---

# Secret Scanning
Expand All @@ -20,6 +20,7 @@ Use this skill when the request involves:
- Excluding directories from secret scanning via `secret_scanning.yml`
- Understanding alert types (user, partner, push protection)
- Enabling validity checks or extended metadata checks
- Scanning local code changes for secrets before committing (via MCP / AI coding agent) — see the **Pre-Commit Scanning via AI Coding Agents** section below for the recommended plugin

## How Secret Scanning Works

Expand Down Expand Up @@ -212,6 +213,23 @@ Dismiss with a documented reason:

> For detailed alert types, validity checks, and REST API, search `references/alerts-and-remediation.md`.

## Pre-Commit Scanning via AI Coding Agents

For scanning code changes for secrets inside an AI coding agent before committing, install the **Advanced Security plugin** which provides the `run_secret_scanning` MCP tool and a dedicated scanning skill.

**GitHub Copilot CLI:**
```
Comment on lines +220 to +221
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The “GitHub Copilot CLI” install instructions use the interactive /plugin install ... command but don’t mention that it must be run inside an interactive Copilot CLI session, and they omit the prerequisite to register the github/copilot-plugins marketplace (per website/src/content/docs/learning-hub/installing-and-using-plugins.md). Consider updating this section to either (a) show the non-interactive CLI command (copilot plugin install advanced-security@copilot-plugins) and include the marketplace add step when needed, or (b) explicitly label the snippet as “from an interactive session” and include /plugin marketplace add github/copilot-plugins if it isn’t already registered.

Suggested change
**GitHub Copilot CLI:**
```
**GitHub Copilot CLI (interactive session):**
```text
/plugin marketplace add github/copilot-plugins

Copilot uses AI. Check for mistakes.
/plugin install advanced-security@copilot-plugins
```

**Visual Studio Code:**
- Install the `advanced-security` agent plugin
- Use `/secret-scanning` in Copilot Chat
Comment on lines +226 to +227
Copy link

Copilot AI Mar 24, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The VS Code guidance is a bit ambiguous ("Install the advanced-security agent plugin"). In this repo’s plugin docs, VS Code discovery/install is described via @agentPlugins in Extensions search or the “Chat: Plugins” command palette entry. Consider updating these bullets to match that documented flow/terminology so readers can reliably find and install the plugin.

Suggested change
- Install the `advanced-security` agent plugin
- Use `/secret-scanning` in Copilot Chat
- In the Extensions view, search for `@agentPlugins advanced-security` and install **Advanced Security** (`advanced-security@copilot-plugins`)
- Or run the **“Chat: Plugins”** command from the Command Palette and enable the **Advanced Security** agent plugin
- Then use `/secret-scanning` in Copilot Chat to scan changes for secrets before committing

Copilot uses AI. Check for mistakes.

See: [Advanced Security Plugin — Secret Scanning Skill](https://github.com/github/copilot-plugins/blob/main/plugins/advanced-security/skills/secret-scanning/SKILL.md)

> Announced in [Secret scanning in AI coding agents via the GitHub MCP Server](https://github.blog/changelog/2026-03-17-secret-scanning-in-ai-coding-agents-via-the-github-mcp-server/) (March 2026)

## Reference Files

For detailed documentation, load the following reference files as needed:
Expand Down
Loading