github-recon

Name: github-recon
Availability: InStock
Author: zebbern

Scan Git repositories and GitHub organizations for exposed API keys and credentials.

5|3|Updated Apr 10, 2026

Search Tags:#security #github #reconnaissance #secrets #credentials #secret-scanning

Ready to run

npx skills add https://github.com/zebbern/termstack --skill github-recon

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: github-recon
Source: https://github.com/zebbern/termstack/tree/main/.github/skills/github-recon
Command: npx skills add https://github.com/zebbern/termstack --skill github-recon

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

The skill provides a security-focused workflow to scan Git repositories, GitHub organizations, and source code for leaked secrets, API keys, and credentials, enabling rapid detection and remediation.

Core Features & Use Cases

Automates secret discovery across repositories, organizations, and commit histories using industry-standard tools.
Supports actionable remediation guidance and integration with common workflows for security reviews and pre-commit checks.
Use cases include identifying exposed keys before deployment, auditing code bases, and alerting teams to credential exposure.

Quick Start

Run a targeted secret scan on a GitHub repository or local directory to identify exposed credentials.

Frequently Asked Questions about github-recon

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan a Git repository for exposed API keys and credentials?▼

To scan a Git repository for exposed API keys and credentials, you can run a targeted secret scan using tools like TruffleHog, Gitleaks, or git-secrets to detect leaked secrets across commit histories. This workflow automates discovery and provides remediation guidance.

What is the best way to find leaked secrets in a GitHub organization?▼

Finding leaked secrets in a GitHub organization requires scanning source code and commit histories across multiple repositories. This skill automates secret discovery by applying structured workflows using industry-standard tools to identify exposed keys for security reviews.

Can I use this to detect credentials in private repository histories?▼

Yes, you can detect credentials in private repository histories. The scanning workflow applies targeted credential investigations across both public and private Git repositories, enabling rapid identification of exposed secrets in past commits.

Does TruffleHog or Gitleaks work better for code audits?▼

Both TruffleHog and Gitleaks are supported for code audits and security reviews. This skill integrates these industry-standard tools into structured workflows, allowing you to choose the appropriate scanner based on your specific secret detection requirements.

When should I run a secret scan during the development lifecycle?▼

You should run a secret scan during security reviews, code audits, and as pre-commit checks to identify exposed keys before deployment. This prevents credential exposure by catching leaked secrets early in the development workflow.