Gitleaks Secret Detector

What this skill does

Runs gitleaks detect against a local git repository and parses the JSON output into structured findings. Each finding reports the rule ID, the type of credential detected, the file and line number, and a redacted match preview. Never returns the full unredacted secret value.

Inputs

• repo_path — absolute or relative path to the git repository root
• config_path — optional path to a custom .gitleaks.toml allowlist config
• branch — optional branch name or commit SHA to scan (default: current HEAD)

Outputs

• findings — list of {rule_id, file, line_number, secret_type, redacted_match, commit} objects
• total_count — total number of secrets detected
• clean — true when total_count == 0

Example

gitleaks detect --source . --report-format json --report-path findings.json

{
  "findings": [
    {
      "rule_id": "aws-access-token",
      "file": "scripts/deploy.sh",
      "line_number": 14,
      "secret_type": "AWS Access Key ID",
      "redacted_match": "AKIA***XYZ",
      "commit": "a3f2c1d"
    }
  ],
  "total_count": 1,
  "clean": false
}

Notes

• Requires gitleaks binary on PATH (brew install gitleaks or download from GitHub releases)
• Use config_path to add allowlist entries for test fixtures or known false positives
• Output never includes the full unredacted secret — only the redacted preview