secret-scan

Scan source code and Git history for secrets using trufflehog or gitleaks.

21|1|Updated Apr 12, 2026

Search Tags:#remediation #git-history #secret-detection #gitleaks #trufflehog #credential-management #source-code

Ready to run

npx skills add https://github.com/woohyun212/security-skill --skill secret-scan

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-scan
Source: https://github.com/woohyun212/security-skill/tree/main/secret-scan
Command: npx skills add https://github.com/woohyun212/security-skill --skill secret-scan

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detects API keys, passwords, tokens, and private keys hidden in source code and git history, preventing credential leakage and accidental exposure.

Core Features & Use Cases

Secret discovery in current code and full git history using trufflehog or gitleaks
Classifies discovered secrets by type and provides remediation guidance
Use cases include pre-commit checks, code reviews, CI pipelines, and incident response

Quick Start

Set SECSKILL_SCAN_PATH to the repository you want to scan and run the secret-scan skill to identify and classify secrets in code and Git history.

Frequently Asked Questions about secret-scan

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my git history for hardcoded secrets and API keys?▼

Scan git history for secrets by setting your repository path and running the scan, which uses tools like trufflehog or gitleaks to discover and classify exposed credentials throughout your full commit history.

What is the best way to detect exposed credentials in source code before committing?▼

Detect exposed credentials in source code before committing by integrating this secret-detection scan into pre-commit checks, identifying hidden API keys and tokens before they enter your repository.

Does secret scanning work with gitleaks and trufflehog for CI pipeline integration?▼

Secret scanning works with gitleaks and trufflehog for CI pipeline integration, scanning current code and full git history to prevent credential leakage during automated builds and incident response.

Do I need to install trufflehog or gitleaks separately to scan code for secrets?▼

You need to install trufflehog or gitleaks separately to scan code for secrets, as these external tools are required to perform the underlying source code and git history credential discovery.

How do I remediate leaked API keys and passwords found in my repository?▼

Remediate leaked API keys and passwords by running a scan that classifies discovered secrets by type and provides targeted remediation guidance to resolve the credential exposure in your source code.