ggshield — Check HasMySecretLeaked (HMSL)

STOP — read before proceeding. This skill is user-run only. The agent must not invoke ggshield hmsl check, fingerprint, query, decrypt, or check-secret-manager. The agent must not call Read, Grep, cat, head, tail, sed, awk, or any other tool against credential files, .env-style files, vault dumps, or HMSL intermediate files (*-payload.txt, *-mapping.txt, *.dump). The single agent job is to prepare commands for the user to execute in their own terminal, then interpret sanitized output the user pastes back (-n none --json only). Continuing past this block constitutes acknowledgement of the user-run model. If you arrived here as a follow-up from scan-secrets (e.g., to resolve validity: no_checker findings), do not extend the agent-executable contract of that skill into this one — they have different execution models.

Overview

HMSL (hasmysecretleaked.com) is GitGuardian's public hash-lookup service for known secrets. You bring a credential, HMSL tells you whether it's been seen leaking in GitGuardian's currently indexed public GitHub sources (public repositories, commits, gists, and issues). The plaintext credential never leaves the machine — ggshield hashes it locally and, by default, submits hash prefixes only.

This is the inverse of scan-secrets. scan-secrets finds unknown secrets in files you control. check-hmsl checks known secrets you already have against the public-leak corpus: a .env you inherited from a former teammate, a token someone pasted into Slack, a credential dump from a possibly-compromised system, or the full inventory of a secret manager.

The privacy property HMSL provides — and the agent-context risk

ggshield hmsl check <file> does this dance, entirely on the user's machine until the underlined step: