secret-scan

What this skill does

Detects API keys, passwords, tokens, and private keys in source code and git history using trufflehog or gitleaks. Classifies discovered secrets by type and provides remediation recommendations.

When to use

• Before publishing code to a public repository to check for secret leaks
• During security audits to detect hardcoded credentials in source code
• During incident response to check git history for past secret exposures
• In CI/CD pipelines to automatically block commits containing secrets

Prerequisites

• trufflehog installed (recommended):

  go install github.com/trufflesecurity/trufflehog/v3@latest
  

• Or gitleaks installed (alternative):

  # Ubuntu/Debian
  GITLEAKS_VERSION=$(curl -s https://api.github.com/repos/gitleaks/gitleaks/releases/latest | grep tag_name | cut -d'"' -f4)
  wget -q "https://github.com/gitleaks/gitleaks/releases/download/${GITLEAKS_VERSION}/gitleaks_${GITLEAKS_VERSION#v}_linux_x64.tar.gz" -O /tmp/gitleaks.tar.gz
  tar -xzf /tmp/gitleaks.tar.gz -C /usr/local/bin gitleaks
  

• Environment variable SECSKILL_SCAN_PATH: path to scan (git repository or directory)

Inputs

Variable	Required	Description
SECSKILL_SCAN_PATH	required	Path to scan (git repository root recommended)
SECSKILL_OUTPUT_DIR	optional	Output directory for results (default: ./output)
SECSKILL_SCAN_TOOL	optional	trufflehog or gitleaks (default: auto-detect)
SECSKILL_SCAN_GIT_HISTORY	optional	Set to true to scan full git history (default: true)

Workflow

Step 1: Environment setup and tool detection

export SCAN_PATH="${SECSKILL_SCAN_PATH:?Set the SECSKILL_SCAN_PATH environment variable}"
export OUTDIR="${SECSKILL_OUTPUT_DIR:-./output}"
export SCAN_GIT="${SECSKILL_SCAN_GIT_HISTORY:-true}"
mkdir -p "$OUTDIR"

if [ ! -e "$SCAN_PATH" ]; then
  echo "[-] Path not found: $SCAN_PATH"
  exit 1
fi

# Auto-detect tool
if [ -n "${SECSKILL_SCAN_TOOL:-}" ]; then
  TOOL="$SECSKILL_SCAN_TOOL"
elif command -v trufflehog >/dev/null 2>&1; then
  TOOL="trufflehog"
elif command -v gitleaks >/dev/null 2>&1; then
  TOOL="gitleaks"
else
  echo "[-] Please install either trufflehog or gitleaks"
  exit 1
fi

echo "[*] Starting secret scan"
echo "[*] Scan tool: $TOOL"
echo "[*] Target path: $SCAN_PATH"
SAFE_NAME=$(basename "$SCAN_PATH")
TIMESTAMP=$(date -u '+%Y%m%dT%H%M%SZ')