What problem does it solve? Secrets like werf global_secret_key, docker credentials, kubeconfig tokens, and SSH keys can silently leak into git commits, logs, or agent messages, and local dev shortcuts (insecure registries, TLS-less Ingress) can drift into production-like environments. This Skill performs read-only security audits and produces a structured report without modifying anything. ## Core Features & Use Cases - Secret Scanning: Searches git history and the working tree with gitleaks, trufflehog, and grep patterns for hardcoded passwords, tokens, and private keys, reporting only paths and types—never values. - Gitignore & Credentials Audit: Verifies that sensitive files (product clones, Helm values, logs, .claude settings) are properly ignored and that host credentials (docker config, kubeconfig, werf keys) never entered the repo. - Ingress/Kubernetes Review: Flags insecure-registry flags, missing TLS on Ingress, and /etc/hosts rewrite risks, distinguishing acceptable local-dev defaults from production violations. - Use Case: Before merging a PR in a Kubernetes CI infrastructure repo, run a full review mode to diff against master, detect newly added unignored files, and receive a Critical/Warnings/OK report with remediation delegated to a devops role. ## Quick Start Ask the agent to run a security audit in secrets mode to scan the repository and git history for leaked credentials and produce a report.
