Secleak Check

Workflow

1. Confirm cwd and repo root.
2. For a scan request, run the bundled script from this skill, not a target-repo script.
3. For a setup request, add repo-local guardrails from references/guardrails.md.
4. Quote exact failing tool output, but never print raw secret values.
5. If the bundled script is unavailable, use the manual fallback commands below.

Bundled command

Resolve scripts/secleak-check.sh relative to this SKILL.md.

Manual fallback

betterleaks git --no-banner --redact=100 .
trivy fs --scanners vuln,secret,misconfig --exit-code 1 .

Prefer .betterleaks.toml when present. If only .gitleaks.toml exists, pass --config .gitleaks.toml; BetterLeaks supports it for compatibility.