secrets

Run the secrets scan with no arguments to check the current codebase, or pass a path for a targeted scan. The skill uses TruffleHog or Gitleaks if installed, otherwise it falls back to Grep-based pattern matching for common credential formats.

TruffleHog is preferred because it combines entropy analysis with pattern matching across 700+ secret types and can verify whether credentials are still active. Gitleaks is a lighter, faster alternative with 140+ built-in patterns and custom rule support.

Yes, pass the --history flag to scan all commits. Findings are classified as active leaks, removed leaks still present in history, or false positives, and the skill shows which commits introduced and removed each secret.

Use BFG Repo Cleaner or git filter-repo to delete the file or replace the secret text across all commits, then force push after coordinating with your team. The skill generates the exact commands and warns that history rewriting requires teammates to re-clone.

The skill falls back to Grep-based pattern detection covering AWS keys, GitHub tokens, Stripe keys, database connection strings, private keys, and generic passwords. It warns that this method has higher false positive rates and no credential verification.

The skill can generate .gitignore rules for env files, credentials, and private keys, and install a pre-commit hook that runs TruffleHog to block commits containing secrets. It also recommends CI/CD scanning and secrets managers like AWS Secrets Manager or Vault.