secrets-scanner
Pass
Audited by Gen Agent Trust Hub on Sep 14, 2026
Risk Level: SAFEEXTERNAL_DOWNLOADSCOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill references official pre-commit hooks and GitHub Actions from the Gitleaks, Yelp, and Truffle Security organizations. These are well-known and trusted sources for security tooling, and the references are consistent with the skill's intended purpose of secret detection.
- [COMMAND_EXECUTION]: Defines a local pre-commit hook that executes a bash command to identify and block the commitment of
.envfiles. This is a defensive security measure designed to prevent accidental data exposure. - [INDIRECT_PROMPT_INJECTION]: Includes a TypeScript utility that reads local file content to scan for regex patterns. While this involves processing potentially untrusted data, the script is a standard security utility intended for local execution by the user, and the ingestion is required for its primary function.
- [CREDENTIALS_UNSAFE]: While the skill contains regex patterns and dummy examples that resemble live credentials (e.g., 'sk_live_abc123xyz789'), these are explicitly used as placeholders or as part of detection rules. No valid production credentials or private keys are exposed.
Audit Metadata