Scan code, JS files, and configs for exposed secrets during reconnaissance.
npx skills add https://github.com/kalpmodi/akira --skill secrets-kalpmodi
Please help me install this Agent Skill. Skill: secrets Source: https://github.com/kalpmodi/akira/tree/main/skills/secrets Command: npx skills add https://github.com/kalpmodi/akira --skill secrets-kalpmodi
Identifies exposed secrets, API keys, tokens, and credentials on a target during a penetration test, reducing manual searching and accidental leakage.
Run a secrets hunt across the target's codebase to identify exposed keys and credentials.
High-intent search queries and answers about installing and using this skill.
This Skill hunts for exposed secrets, API keys, and credentials across code, JS files, and configurations during pentest reconnaissance. It uses tools like trufflehog or gitleaks to surface verified secrets with context.
Yes, you need trufflehog or gitleaks installed to scan for exposed secrets. These external tools perform the automated detection across your target's codebase and configurations during the reconnaissance phase.
Verified credentials are documented by writing high-confidence findings to interesting_secrets.md. The scan also updates session.json, specifically populating intel.credentials and marking the secrets node as done to track progress.
Automating secret detection across repositories is best done by running a secrets hunt during phase 2 reconnaissance. This approach uses available recon scope to scan code and configs, summarizing verified findings into a dedicated markdown report.
Yes, you can use this secrets scan during phase 2 reconnaissance. It is specifically designed to identify exposed keys and tokens across target codebases and configurations while tracking progress in your pentest session.
Kalp1774Aggregate pentest findings into a severity-clustered triage.md with confidence scores.
pdparchitectAnalyze cloud IAM privilege escalation paths across AWS, Azure, and GCP.
dapperdiversIdentify exposed services, technologies, directories, and TLS configurations on web applications.
cbbkrd-techScan codebases for hardcoded secrets using gitleaks and trufflehog.
