source-leak-hunt

Name: source-leak-hunt
Availability: InStock
Author: entrovyx

Scan multiple domains for exposed sensitive files like .env and .git/config.

3|1|Updated Jul 2, 2026

Search Tags:#security #vulnerability #secrets #pentest #exposure #recon

Ready to run

npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill source-leak-hunt-entrovyx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: source-leak-hunt
Source: https://github.com/EntroVyx/hermes-agent-offsec/tree/main/skills/offsec/recon/source-leak-hunt
Command: npx skills add https://github.com/EntroVyx/hermes-agent-offsec --skill source-leak-hunt-entrovyx

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires curl, nmap, python3, masscan, subfinder, httpx, nuclei.

What problem does it solve?

This skill addresses the critical security risk of accidentally exposed sensitive files like environment variables, database backups, and git configurations that can lead to full system compromise.

Core Features & Use Cases

Mass Scanning: Efficiently probes large lists of domains for common sensitive file paths.
Content-Based Filtering: Uses pattern matching to verify leaks, significantly reducing false positives from parked domains or SPA catch-all pages.
Use Case: Use this during the reconnaissance phase of a security assessment to quickly identify misconfigured servers leaking database credentials or source code.

Quick Start

Run the source-leak-hunt skill by providing a text file containing a list of target URLs to scan for exposed sensitive files.

Frequently Asked Questions about source-leak-hunt

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan multiple domains for exposed sensitive files like .env and .git config?▼

You can scan multiple domains for exposed sensitive files by providing a text file containing target URLs to perform mass scanning for misconfigured servers leaking credentials and source code.

Can I use mass scanning to find exposed database backups and environment variables across large target lists?▼

Yes, mass scanning efficiently probes large lists of domains for common sensitive file paths, identifying exposed environment variables and database backups to prevent full system compromise.

How do I reduce false positives when scanning for exposed .env files and config leaks?▼

Content-based filtering uses pattern matching to verify leaks, significantly reducing false positives from parked domains or SPA catch-all pages during sensitive file exposure scanning.

Do I need subfinder and nuclei to identify exposed secrets and config files?▼

Yes, identifying exposed secrets requires subfinder for network discovery and nuclei for content verification, along with curl, nmap, python3, masscan, and httpx.

What is the best way to find credential exposure during a security assessment reconnaissance phase?▼

The best way to find credential exposure during reconnaissance is using a dedicated source leak hunting skill to quickly identify misconfigured servers leaking database credentials or source code.

When should I not use automated sensitive file scanning for vulnerability assessment?▼

Automated sensitive file scanning is not recommended without proper authorization, as probing target domains for exposed configurations and credentials requires explicit permission during security assessments.