scan-secrets
Pass
Audited by Gen Agent Trust Hub on Oct 23, 2026
Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [CREDENTIALS_UNSAFE]: The file
evals/files/_shared/secrets.envcontains hardcoded synthetic credentials, including AWS keys, GitHub tokens, Stripe keys, and database passwords. These are documented as non-functional, real-shape values used exclusively for testing the scanner's detection capabilities within the skill's evaluation fixtures and are marked with# ggignoreto suppress internal alerts. - [EXTERNAL_DOWNLOADS]: The skill references and provides commands to download the
ggshieldCLI installation scripts and binaries from GitGuardian's official GitHub repository (github.com/GitGuardian/ggshield) and legitimate package registries (Homebrew, Choco, Cloudsmith). These are official distribution points for the tool required by the skill. - [COMMAND_EXECUTION]: The skill instructions involve executing the
ggshieldCLI for scanning files, git history, and Docker images, as well as managing authentication and installing hooks. These operations are the intended core functionality of the secret-scanning skill.
Audit Metadata