secleak-check
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The GitHub Action template in
references/guardrails.mddownloads thebetterleaksbinary from its official repository. The download is protected by a SHA256 checksum verification, which is a security best practice for remote installers. - [COMMAND_EXECUTION]: The skill uses several shell scripts (
scripts/secleak-check.sh) and Node.js scripts (scripts/block-forbidden-staged-files.mjs) to execute standard security tools likegit,betterleaks, andtrivy. These operations are performed locally on the repository files for scanning purposes. - [DATA_EXFILTRATION]: While the skill accesses sensitive paths (e.g.,
~/.aws/credentials,.env), it does so solely to prevent these files from being committed to version control. The logic inscripts/block-forbidden-staged-files.mjsand the patterns in.forbidden-paths.regexare designed as defensive guardrails to block the staging of sensitive data. No data is sent to external servers; findings are only logged to the local console for the user.
Audit Metadata