Scan files, endpoints, and repositories for exposed secrets and credentials.
npx skills add https://github.com/Kalp1774/akira --skill secrets-kalp1774
Please help me install this Agent Skill. Skill: secrets Source: https://github.com/Kalp1774/akira/tree/main/skills/secrets Command: npx skills add https://github.com/Kalp1774/akira --skill secrets-kalp1774
Identifies and verifies exposed secrets, API keys, tokens, and credentials within a pentest target to reduce noisy findings and ensure every reported secret has supporting evidence.
Run the secrets skill to scan the target using available recon scope and produce a verified interesting_secrets.md that updates session.json.
High-intent search queries and answers about installing and using this skill.
Exposed secrets are identified by scanning JavaScript files and repository artifacts with trufflehog and gitleaks, then performing GitHub dorking and API spec discovery. It verifies findings to reduce noise and produces an interesting_secrets.md summary with supporting evidence.
Verifying exposed secrets involves evidence-gated checks on trufflehog and gitleaks outputs against live hosts. This Skill focuses on confirmed findings to reduce noise, producing a concise interesting_secrets.md that summarizes verified credentials with supporting evidence.
Yes, trufflehog and gitleaks outputs can be used for credential hunting. This Skill accepts those outputs alongside optional gh CLI results, scanning recon-provided URLs and live hosts to extract endpoints and hand off discovered credentials to downstream pentest phases.
GitHub dorking searches repositories for sensitive patterns to expand the credential hunting surface. It complements trufflehog and gitleaks scans by extracting endpoints and discovering API or Postman specs for later exploitation and analysis.
Yes, this approach probes common API and Postman spec paths to expand the search surface. It extracts endpoints from these specs for later exploitation, adding supplementary hunting results to the verified interesting_secrets.md findings summary.
Integrating discovered credentials involves writing results into the pentest toolkit results directory and updating session.json. This operational integration hands off verified credentials to downstream phases, ensuring every reported secret has supporting evidence.
guaidao2Probe live HTTP and HTTPS hosts and collect response metadata.
kalpmodiScan code, JS files, and configs for exposed secrets during reconnaissance.
AskTinNguyenDiscovers and analyzes GitHub repositories to extract patterns and knowledge.
CodingHeaderRun verification commands and compare output against expectations before claiming completion.
