Run any Skill in Manus with one click

secrets-hunter

Stars2

Forks0

UpdatedApril 20, 2026 at 19:28

Find credentials, API keys, tokens, private keys, and high-entropy strings in target/. Combines gitleaks, trufflehog, detect-secrets, ggshield, and manual entropy grep. Triages each hit for live vs. test vs. revoked.

Installation

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

Run Skill in Manus

Source

rasata

rasata/coldvault.dev

View GitHub Repository View Creator Repositories

Download

Run Skill in Manus

Related occupationsSOC

Based on SOC occupation classification

Information Security AnalystsComputer and Mathematical Occupations·SOC 15-1212

SKILL.md

readonly

name	secrets-hunter
description	Find credentials, API keys, tokens, private keys, and high-entropy strings in target/. Combines gitleaks, trufflehog, detect-secrets, ggshield, and manual entropy grep. Triages each hit for live vs. test vs. revoked.
license	MIT (ZONOVA RESEARCH — coldvault.dev)

secrets-hunter

Run

# 1. gitleaks — rules are pattern-based, fast, covers git history too
gitleaks detect --source target --no-git --report-format sarif \
  --report-path reports/secrets-gitleaks.sarif

gitleaks detect --source target --report-format sarif \
  --report-path reports/secrets-gitleaks-history.sarif || true

# 2. trufflehog — can verify AWS / GitHub / Slack / Stripe tokens against the
#    provider's API. DISABLE verification unless the analyst opts in, to avoid
#    telemetry / beacons.
trufflehog filesystem target --json --no-verification > reports/secrets-trufflehog.json

# 3. detect-secrets — Python-first, lower FP rate for private keys
detect-secrets scan target > reports/secrets-detect.json

# 4. ggshield — GitGuardian rules (very broad)
ggshield secret scan path -r --json target > reports/secrets-ggshield.json || true

Triage rubric

For every candidate secret:

Signal	Severity
Matches a real regex + high entropy + in a non-test path	HIGH
Matches a real regex + in a test / example	LOW (report anyway)
Verified live (trufflehog `--verification`)	CRITICAL
In git history but not in HEAD	MEDIUM (rotation still required)
`.env.example`, fake-looking	INFO (don't report)

Categories to surface

AWS / GCP / Azure access keys
GitHub PATs (ghp_…), GitLab tokens, SSH private keys (-----BEGIN …)
Database connection strings with password
JWT signing secrets
Stripe, Twilio, SendGrid, Slack webhook URLs
.npmrc //registry.npmjs.org/:_authToken
Container registry creds in ~/.docker/config.json
Hardcoded cryptographic keys in source

Never do this

Never run verification (trufflehog --only-verified without --no-verification) without explicit analyst consent — it can tip off the attacker (telemetry), and can cost real money on some providers.
Never copy the actual secret value into reports/ — redact to first/last 4 chars: ghp_ABCD…WXYZ.
Never commit reports/ (enforced by .gitignore).

More from this repository

same repository

defensive-payload-analysis

rasata/coldvault.dev

Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).

2026-04-212

html-report-renderer

rasata/coldvault.dev

Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.

2026-04-212

agentic-actions-auditor

rasata/coldvault.dev

Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).

2026-04-202

audit-context-building

rasata/coldvault.dev

Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.

2026-04-202

constant-time-analysis

rasata/coldvault.dev

Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.

2026-04-202

entry-point-analyzer

rasata/coldvault.dev

Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.

2026-04-202

name	secrets-hunter
description	Find credentials, API keys, tokens, private keys, and high-entropy strings in target/. Combines gitleaks, trufflehog, detect-secrets, ggshield, and manual entropy grep. Triages each hit for live vs. test vs. revoked.
license	MIT (ZONOVA RESEARCH — coldvault.dev)

secrets-hunter

Run

# 1. gitleaks — rules are pattern-based, fast, covers git history too
gitleaks detect --source target --no-git --report-format sarif \
  --report-path reports/secrets-gitleaks.sarif

gitleaks detect --source target --report-format sarif \
  --report-path reports/secrets-gitleaks-history.sarif || true

# 2. trufflehog — can verify AWS / GitHub / Slack / Stripe tokens against the
#    provider's API. DISABLE verification unless the analyst opts in, to avoid
#    telemetry / beacons.
trufflehog filesystem target --json --no-verification > reports/secrets-trufflehog.json

# 3. detect-secrets — Python-first, lower FP rate for private keys
detect-secrets scan target > reports/secrets-detect.json

# 4. ggshield — GitGuardian rules (very broad)
ggshield secret scan path -r --json target > reports/secrets-ggshield.json || true

Triage rubric

For every candidate secret:

Signal	Severity
Matches a real regex + high entropy + in a non-test path	HIGH
Matches a real regex + in a test / example	LOW (report anyway)
Verified live (trufflehog `--verification`)	CRITICAL
In git history but not in HEAD	MEDIUM (rotation still required)
`.env.example`, fake-looking	INFO (don't report)

Categories to surface

AWS / GCP / Azure access keys
GitHub PATs (ghp_…), GitLab tokens, SSH private keys (-----BEGIN …)
Database connection strings with password
JWT signing secrets
Stripe, Twilio, SendGrid, Slack webhook URLs
.npmrc //registry.npmjs.org/:_authToken
Container registry creds in ~/.docker/config.json
Hardcoded cryptographic keys in source

Never do this

Never run verification (trufflehog --only-verified without --no-verification) without explicit analyst consent — it can tip off the attacker (telemetry), and can cost real money on some providers.
Never copy the actual secret value into reports/ — redact to first/last 4 chars: ghp_ABCD…WXYZ.
Never commit reports/ (enforced by .gitignore).