Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/addxai/enterprise-harness-engineering/trufflehog-clinpx skills add addxai/enterprise-harness-engineering --skill trufflehog-cligit clone --depth 1 https://github.com/addxai/enterprise-harness-engineeringWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/addxai/enterprise-harness-engineering/trufflehog-cli)<a href="https://agentmods.dev/skills/addxai/enterprise-harness-engineering/trufflehog-cli"><img src="https://agentmods.dev/badge/skills/addxai/enterprise-harness-engineering/trufflehog-cli.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00067 | $0.01141 |
| Opus 5 | $0.00034 | $0.00571 |
| Sonnet 5 | $0.00013 | $0.00228 |
| Haiku 4.5 | $0.00007 | $0.00114 |
Grade A, and why
trufflehog-cli scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 144 lines — stays where its author put it; the contents beside it link to each section on GitHub.
trufflehog-cli
Unified entry point Skill for TruffleHog CLI in this repository.
Load modules on demand:
- Installation, version pinning, checksum verification, and temp-file strategy: install-and-baseline.md
- Local workspace + local Git history scanning: local-scan.md
- Pre-commit integration: pre-commit.md
- Remote GitLab repository scanning: remote-repo-scan.md
- Single-credential identification and verification: credential-verify.md
- Common credential types and verification patterns: credential-types.md
- JSONL report field reference: trufflehog-jsonl-format.md
For reproducible, auditable installation workflows, use the built-in scripts:
- POSIX install: install-trufflehog.sh
- PowerShell install: install-trufflehog.ps1
For pre-commit, use the built-in wrapper script:
- POSIX pre-commit wrapper: pre-commit-trufflehog.sh
Description
Treat this Skill as the company's standard operating manual for TruffleHog CLI.
It covers four primary workflows:
- Local scanning: developer workstation files and local Git history
- Pre-commit integration: block new leaks before they are committed
- Remote repository scanning: scan a single HTTPS remote repository
- Credential verification: confirm whether a leaked credential is still active
Do not extend this Skill into general-purpose SAST, dependency vulnerability scanning, or code auditing.
Rules
Rule 1 - Read the unified baseline first
Read install-and-baseline.md first.
Baseline rules apply to all workflows:
- Version is sourced from trufflehog-version.txt as the single source of truth
- Must use official GitHub Release binaries and verify the official checksum
- All commands must include
--no-updateby default - Scan artifacts go to the system temp directory, never the repository root
- Tokens must not appear in repository URLs or command-line arguments
- Reports may only use TruffleHog's
Redactedoutput; raw secret values must never be printed
What ships with it
11 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- agents/openai.yaml 288 B
- references/credential-types.md 1.6 KB
- references/credential-verify.md 1.7 KB
- references/install-and-baseline.md 2.5 KB
- references/local-scan.md 1.7 KB
- references/pre-commit.md 1.2 KB
- references/remote-repo-scan.md 2.8 KB
- references/trufflehog-jsonl-format.md 1.1 KB
- scripts/install-trufflehog.ps1 3.7 KB runs code
- scripts/install-trufflehog.sh 3.5 KB runs code
- scripts/pre-commit-trufflehog.sh 493 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 6d ago First seen · 144 lines · 67 tokens per session scan A ea440f8da1d4
trufflehog-cli is a skill published in the GitHub repository addxai/enterprise-harness-engineering (44 stars, last pushed 4mo ago), licensed Apache-2.0. It adds 67 tokens to every session and 1,141 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
git-guardrails
Use this skill to enforce strict safety boundaries on git operations, branch management, and destructive shell commands. Prevents accidental force pushes, hard resets, secret commits, unstashed code loss, and unauthorized production branch modifications.
git-advanced-workflows
Master advanced Git workflows including rebasing, cherry-picking, bisect, worktrees, and reflog to maintain clean history and recover from any situation. Use when managing complex Git histories, collaborating on feature branches, or troubleshooting repository issues.
workflow-patterns
Use this skill when implementing tasks according to Conductor's TDD workflow, handling phase checkpoints, managing git commits for tasks, or understanding the verification protocol.
chinese-git-workflow
国内 Git 平台配置参考——Gitee、Coding.net、极狐 GitLab、CNB 的 SSH/HTTPS/凭据/CI 接入差异与镜像同步配置。仅在用户显式 /chinese-git-workflow 时调用，不要根据上下文自动触发。.
chinese-commit-conventions
中文 commit 与 changelog 配置参考——Conventional Commits 中文适配、commitlint/husky/commitizen 中文模板、conventional-changelog 中文配置。仅在用户显式 /chinese-commit-conventions 时调用，不要根据上下文自动触发。.
peon-ping-toggle
Toggle peon-ping sound notifications on/off. Use when user wants to mute, unmute, pause, or resume peon sounds during a Claude Code session. Also handles config changes like volume, pack rotation, categories — any peon-ping setting.