skills.rest
0x53c7
0x53c7OFFICIAL
Explore all skills by this author →
GitHub

secret-scanner

Scan codebases for hardcoded secrets using TruffleHog filesystem scans.

1|Updated Mar 6, 2026
Search Tags:#security#codebase#credentials#scan#trufflehog#secret#scanner
One-click install
npx skills add https://github.com/0x53c7/security-testing-rovodev-skills --skill secret-scanner-0x53c7
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secret-scanner
Source: https://github.com/0x53c7/security-testing-rovodev-skills/tree/main/.rovodev/skills/secret-scanner
Command: npx skills add https://github.com/0x53c7/security-testing-rovodev-skills --skill secret-scanner-0x53c7

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Detect hardcoded secrets, API keys, and credentials in a codebase to prevent leakage and abuse.

Core Features & Use Cases

  • Automated secret detection: Runs TruffleHog to identify secrets in source files and history.
  • Swift remediation guidance: Outputs findings with file paths, lines, and detector names to facilitate rotation.
  • Use Case: Integrate into CI to catch secrets before merging or during code reviews.

Quick Start

Run trufflehog against the target codebase to identify hardcoded secrets and credentials immediately.

Frequently Asked Questions about secret-scanner

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a codebase for hardcoded secrets and credentials?▼

To scan a codebase for hardcoded secrets, this Skill runs TruffleHog against your source files and optional git history to identify exposed API keys and prevent leakage. It outputs JSON lines detailing detector names, verification status, and source metadata.

How does TruffleHog output scan results for code reviews?▼

TruffleHog outputs scan results as JSON lines containing DetectorName, Verified, Redacted, and SourceMetadata fields. This format provides exact file paths and lines to facilitate swift remediation and secret rotation during code reviews.

Can I filter secret scanner results to only show verified credentials?▼

Yes, you can filter secret scanner results to only show verified credentials by applying the optional --only-verified flag. This ensures your code review focuses strictly on active, confirmed hardcoded secrets rather than false positives.

What is the best way to catch hardcoded secrets in a CI pipeline?▼

The best way to catch hardcoded secrets in a CI pipeline is integrating automated TruffleHog filesystem scans as pre-commit checks. This detects credentials in current files and git history before merging, preventing leakage.

Does this secret scanner work with software projects of any size?▼

Yes, this secret scanner works with software projects of any size, applying TruffleHog filesystem scans to detect credentials. It is designed for pre-commit checks and CI pipelines regardless of your repository's scale.

Why scan git history for hardcoded secrets instead of just current files?▼

Scanning git history for hardcoded secrets finds credentials committed previously but later deleted from current files. Running TruffleHog with optional git history scanning ensures past leaks are caught and remediated before abuse.

Related Skills

Explore More Software Engineering Skills→
YukiIto1999YukiIto1999

detecting-aws-credential-exposure-with-trufflehog

Detect exposed AWS credentials in repositories and CI/CD pipelines with TruffleHog.

Community
Advanced
Clear-CapabilitiesClear-Capabilities
73

agentic-security:security-rotate-leak

Rotate leaked API keys and credentials end-to-end across supported providers.

Official
Advanced
riandeoliveirariandeoliveira

implementing-secret-scanning-with-gitleaks

Scan Git repositories with Gitleaks to detect and prevent hardcoded credentials.

Community
Advanced
DonTiziDonTizi
2

security-audit

Scan codebases for secrets, OWASP risks, and vulnerable dependencies.

Community
Advanced