secrets

Scan code, JS files, and configs for exposed secrets during reconnaissance.

18|3|Updated Apr 16, 2026

Search Tags:#secrets #credentials #pentest #secret-detection #gitleaks #trufflehog #recon

Ready to run

npx skills add https://github.com/kalpmodi/akira --skill secrets-kalpmodi

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secrets
Source: https://github.com/kalpmodi/akira/tree/main/skills/secrets
Command: npx skills add https://github.com/kalpmodi/akira --skill secrets-kalpmodi

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Identifies exposed secrets, API keys, tokens, and credentials on a target during a penetration test, reducing manual searching and accidental leakage.

Core Features & Use Cases

Automated secrets scan across code, configurations, and JS files using recon scope when available
Summarizes verified findings into interesting_secrets.md and highlights high-confidence secrets
Updates session.json intel.credentials and marks the secrets node as done to track progress

Quick Start

Run a secrets hunt across the target's codebase to identify exposed keys and credentials.

Frequently Asked Questions about secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I find exposed API keys and credentials during a pentest?▼

This Skill hunts for exposed secrets, API keys, and credentials across code, JS files, and configurations during pentest reconnaissance. It uses tools like trufflehog or gitleaks to surface verified secrets with context.

Do I need trufflehog or gitleaks to scan for exposed secrets?▼

Yes, you need trufflehog or gitleaks installed to scan for exposed secrets. These external tools perform the automated detection across your target's codebase and configurations during the reconnaissance phase.

How are verified credentials documented after a secrets hunt?▼

Verified credentials are documented by writing high-confidence findings to interesting_secrets.md. The scan also updates session.json, specifically populating intel.credentials and marking the secrets node as done to track progress.

What is the best way to automate secret detection across code repositories?▼

Automating secret detection across repositories is best done by running a secrets hunt during phase 2 reconnaissance. This approach uses available recon scope to scan code and configs, summarizing verified findings into a dedicated markdown report.

Can I use this secrets scan during the reconnaissance phase of a penetration test?▼

Yes, you can use this secrets scan during phase 2 reconnaissance. It is specifically designed to identify exposed keys and tokens across target codebases and configurations while tracking progress in your pentest session.