gitleaks
Pass
Audited by Gen Agent Trust Hub on Nov 13, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill is purely instructional, providing a guide on how to use the Gitleaks CLI tool to scan repositories and directories for sensitive information like API keys and tokens.
- [EXTERNAL_DOWNLOADS]: The documentation references official resources for Gitleaks, including its GitHub repository (gitleaks/gitleaks) and official GitHub Actions (gitleaks/gitleaks-action). These are well-known services used for security auditing and do not constitute a security risk in this context.
- [COMMAND_EXECUTION]: The skill lists standard CLI commands for Gitleaks (e.g.,
gitleaks git .,gitleaks dir .). These are documented for the user's benefit and do not perform unauthorized operations. - [INDIRECT_PROMPT_INJECTION]: While the tool processes untrusted data (source code in repositories), it functions as a scanner that outputs findings to a report or terminal. There is no mechanism in the skill that would allow instructions embedded in the scanned data to influence the agent's logic or execute arbitrary commands.
Audit Metadata