菜单
Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/NoorQureshi/SploitAgent --skill code-review-secrets-detection命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
正在显示 SKILL.md
| name | code-review-secrets-detection |
| description | Find leaked secrets in code, git history, and CI. Load on "secrets", "leaked key", a repo/ git history in scope, exposed .git, CI config review, or public-repo OSINT. Signals: API keys, tokens, .env files, private keys, cloud creds, hardcoded passwords. |
| domain | code-review |
| type | technique |
| stability | learning |
| modes | ["bugbounty","defense"] |
| severity | high |
| cwe | ["CWE-798","CWE-540"] |
| mitre | ["T1552.001"] |
| tools | ["trufflehog","gitleaks","git"] |
| schema_version | 1 |
Any source you can read: an in-scope repo, an exposed .git/ on a web server, public GitHub
repos of the org, or CI/CD config. Live secrets are direct, high-impact findings.
Secrets get committed and then "removed" — but git keeps history, so they persist in old commits, branches, and stashes. Config/CI files and client bundles also embed keys that ship to users.
trufflehog git file://. --only-verified or
gitleaks detect --source . -v — these walk every commit and (trufflehog) verify keys live.git-dumper http://target/.git/ out/ then scan the recovered repo.trufflehog github --org=<org> for public leaks (in scope only)..env, Dockerfiles, k8s manifests,
CI YAML for keys and tokens.aws sts get-caller-identity) — a live, privileged key is the report; a dead one is informational.A secret that authenticates successfully (minimal proof), with where it lives (commit/file) — don't paste the secret value into reports, reference its location.
trufflehog & gitleaks docs; GitHub secret-scanning; OWASP secrets management.