The Agent Skills Directory

[EXTERNAL_DOWNLOADS]: The skill facilitates the download of the TruffleHog binary from its official GitHub repository.
Evidence: scripts/install-trufflehog.sh and scripts/install-trufflehog.ps1 download release assets from https://github.com/trufflesecurity/trufflehog/releases. The scripts include mandatory SHA256 checksum verification and optional signature verification using cosign to ensure the authenticity of the downloaded binary.
[COMMAND_EXECUTION]: The skill utilizes several shell and PowerShell commands to manage the installation and execution of the scanner.
Evidence: scripts/install-trufflehog.sh executes curl, tar, and install. references/local-scan.md and references/remote-repo-scan.md provide commands to run trufflehog and git for scanning purposes.
[DATA_EXFILTRATION]: The skill includes procedures for verifying discovered credentials by making read-only probes to official service APIs.
Evidence: references/credential-verify.md provides examples using curl to test tokens against official endpoints such as https://api.github.com/user and https://gitlab.example.com/api/v4/personal_access_tokens/self. This activity is inherent to the skill's purpose of validating secret leaks and is documented to be performed via secure, non-persistent methods.

trufflehog-cli