secret-scan-trufflehog
Pass
Audited by Gen Agent Trust Hub on Aug 24, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
- [COMMAND_EXECUTION]: The skill instructs the agent to run the
trufflehogCLI tool with parameters such as repository paths and organization names. These parameters are sourced from user requests and interpolated into shell commands to perform the scan. - [INDIRECT_PROMPT_INJECTION]: 1. Ingestion points: The agent ingests data from local filesystems, git repositories, and remote GitHub organizations during the scanning process (SKILL.md). 2. Boundary markers: The instructions lack explicit boundary markers or directives for the agent to disregard instructions that might be embedded within the scanned content. 3. Capability inventory: The agent has the capability to execute shell commands and write output to files (
trufflehog-results.json). 4. Sanitization: The skill includes a clear directive to redact secret values in the final report, mitigating the risk of accidental exposure of the discovered credentials. - [EXTERNAL_DOWNLOADS]: The documentation references installing the
trufflehogutility viapiporbrew. These are standard methods for obtaining this well-known security tool.
Audit Metadata