github-secret-hunting
Warn
Audited by Gen Agent Trust Hub on Jul 31, 2026
Risk Level: MEDIUMCOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTIONDATA_EXFILTRATION
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill downloads code from an external GitHub repository (
Proviesec/github-dorks) and subsequently executes it usingpython3 GitDorker.pywithout verification. - [EXTERNAL_DOWNLOADS]: Fetches multiple security tools, document files, and Docker images from various external domains, including GitHub, Docker Hub, and target web servers.
- [COMMAND_EXECUTION]: Relies heavily on executing system commands and CLI tools (
trufflehog,gitleaks,shhgit,metafinder,gau,httpx,exiftool) to scan repositories and process metadata. - [DATA_EXFILTRATION]: Automatically identifies potential secrets (API keys, tokens) and transmits them to external services such as OpenAI and GitHub APIs to verify their validity.
Audit Metadata