trufflehog
Pass
Audited by Gen Agent Trust Hub on Sep 3, 2026
Risk Level: SAFECOMMAND_EXECUTIONINDIRECT_PROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to execute the
trufflehogCLI tool to scan local and remote resources for secrets. Evidence: Commands such astrufflehog git file:///path/to/contoso-repo,trufflehog filesystem /path/to/contoso-code/, andtrufflehog s3 --bucket=contoso-prod-backupare documented for use. - [INDIRECT_PROMPT_INJECTION]: The skill involves processing data from external, potentially untrusted sources (git repositories, filesystems, and S3 buckets) which presents an attack surface for indirect prompt injection. 1. Ingestion points: Data is ingested from the specified filesystem paths, git repositories, and S3 buckets during scanning (SKILL.md). 2. Boundary markers: Not explicitly defined for the tool output, although instructions mention scoping and triaging findings. 3. Capability inventory: The skill utilizes shell command execution for the
trufflehogCLI. 4. Sanitization: The procedure includes a step to redact raw secret values from evidence to minimize data exposure.
Audit Metadata