mundi-qmd-secret-scan-precommit
Pass
Audited by Gen Agent Trust Hub on Jul 15, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill automates the setup of
pre-commitandgitleaks, which are industry-standard tools for ensuring repository security. It provides templates for configuration files that enforce security policies. - [EXTERNAL_DOWNLOADS]: The skill references the official GitHub repository for Gitleaks (
https://github.com/gitleaks/gitleaks) to fetch the hook definition. GitHub is a well-known service, and this repository is a standard source for this tool. It also uses standard package managers (piporbrew) to install thepre-commitframework. - [COMMAND_EXECUTION]: The skill uses
Bashto install packages and initialize git hooks. These operations are restricted to the intended purpose of repository onboarding and security auditing. - [DATA_EXPOSURE]: The skill identifies sensitive patterns (e.g., Google API keys, Anthropic keys) using regex to prevent their exposure. While it references a file containing legitimate secrets (
config/api_keys.json), it does so only to facilitate the creation of an allowlist within the local security tool, which is a standard practice for reducing false positives.
Audit Metadata