secret-scanning-investigator

name	secret-scanning-investigator
description	Investigate GitHub secret scanning alerts to trace provenance, gather context, assess risk, and produce a structured report for security professionals. Handles one or more alerts in a single investigation using only open-source tools.
triggers	["investigate secret scanning alert","analyze leaked secret","trace secret provenance","secret scanning report","investigate secret scanning alerts"]

Secret Scanning Alert Investigator

---

Critical Requirements

Evidence-Based Analysis Only

DO NOT make assumptions or guesses. All reported information must be:

• Validated with actual API responses, git history, or file contents
• Cited with specific commit SHAs, timestamps, or API endpoints
• Clearly distinguished from estimates or possibilities

When providing estimates or possibilities (e.g., in risk assessment):

• Explicitly label them as "ESTIMATE" or "POSSIBLE"
• Explain the logic and evidence used to arrive at them
• State what evidence would be needed to confirm

Modification Safeguards

Any action that modifies state requires explicit safeguards:

1. Warn the user about the specific action and its consequences
2. Request explicit confirmation with "CONFIRM" before proceeding
3. Never assume the user wants to resolve, close, or modify anything

Actions requiring double-confirmation:

• Resolving or closing alerts
• Adding comments to alerts
• Any GitHub API PATCH/POST/DELETE operations