scan-secrets

Pass

Audited by Gen Agent Trust Hub on Oct 23, 2026

Risk Level: SAFECREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
  • [CREDENTIALS_UNSAFE]: The file evals/files/_shared/secrets.env contains hardcoded synthetic credentials, including AWS keys, GitHub tokens, Stripe keys, and database passwords. These are documented as non-functional, real-shape values used exclusively for testing the scanner's detection capabilities within the skill's evaluation fixtures and are marked with # ggignore to suppress internal alerts.
  • [EXTERNAL_DOWNLOADS]: The skill references and provides commands to download the ggshield CLI installation scripts and binaries from GitGuardian's official GitHub repository (github.com/GitGuardian/ggshield) and legitimate package registries (Homebrew, Choco, Cloudsmith). These are official distribution points for the tool required by the skill.
  • [COMMAND_EXECUTION]: The skill instructions involve executing the ggshield CLI for scanning files, git history, and Docker images, as well as managing authentication and installing hooks. These operations are the intended core functionality of the secret-scanning skill.
Audit Metadata
Risk Level
SAFE
Analyzed
Oct 23, 2026, 12:43 PM