git-secrets-scanner_skill

Overview

This skill is a git secrets scanner that detects sensitive information in commits, history, and staged changes. It focuses on API keys, passwords, tokens, private keys, and common secret patterns. The skill recommends and orchestrates tools like Gitleaks, TruffleHog, and git-secrets for local, pre-commit, and CI scanning.

How this skill works

The scanner inspects repository files, commit history, specific commits, and staged changes using configurable rules and regex patterns. It can run quick scans on the current repo, deep scans across all history, and targeted checks on single commits. Integrations include pre-commit hooks and CI actions to automate detection before merge or deployment.

When to use it

• Before committing code to detect secrets in staged changes
• When onboarding a repo to scan full history for prior leaks
• In CI/CD pipelines to block pull requests containing secrets
• During audits or routine scheduled scans across many repositories
• After a suspected compromise to locate leaked keys in history

Best practices

• Enable pre-commit scanning (git-secrets or gitleaks protect) to catch issues early
• Run full-history scans after adding the tool to an existing repo to uncover past leaks
• Automate weekly or nightly scans for large codebases and multi-repo environments
• Use allowlists and custom rules to reduce false positives and tune entropy thresholds
• Revoke and rotate any discovered keys immediately and remove them from git history with tools like BFG

Example use cases

• Block merge when a developer accidentally commits an API key by using a pre-commit gitleaks check
• Scan all company repositories in a cron job to find leaked secrets introduced months ago
• Integrate gitleaks action into GitHub Actions to fail PRs that introduce high-risk tokens
• Use TruffleHog to validate whether discovered secrets are live and need immediate revocation
• Create a custom gitleaks config to detect proprietary API key formats (example: moltbook_sk_... )