菜单
Find credentials, API keys, tokens, private keys, and high-entropy strings in target/. Combines gitleaks, trufflehog, detect-secrets, ggshield, and manual entropy grep. Triages each hit for live vs. test vs. revoked.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Conduct a passive, read-only forensic analysis of a potentially malicious source-code tree. Use this skill when the user suspects a repository, archive, or directory contains hidden payloads, C2 code, obfuscated droppers, or compromised build configs (e.g. injected `tailwind.config.js`, trojaned `package.json` postinstall, suspicious base64 blobs). Produces a full report: attacker signature, payload location, statically decrypted IoCs (C2 IPs, ports, paths, XOR keys, drop paths, exfil endpoints).
Render reports/findings.json + reports/SUMMARY.md into a single-file, self-contained reports/SUMMARY.html whose visual quality matches the /reports/example-summary page on coldvault.dev. No external fonts, no JS framework, no network fetches — the user can double-click the file, email it, or host it anywhere.
Audit GitHub Actions / GitLab CI / CircleCI / Azure Pipelines workflows shipped in target/. Flags the high-risk patterns that have caused real-world supply-chain compromises (pwnrequest, pull_request_target, unpinned actions, secret exfiltration, script-injection via PR title/body).
Inventory the suspect repository (languages, frameworks, package managers, entry points, build system, CI) before any scan. Always run this first — subsequent skills depend on its output.
Inspect cryptographic code for timing leaks. Flags variable-time comparisons on secrets, early-exit loops, and library calls known to be variable-time. Limited static scope — the definitive check is micro-benchmarks on compiled binaries, but ~70% of timing bugs show up in source review.
Map the attack surface of target/ — HTTP routes, CLI commands, exported library symbols, message-queue consumers, GitHub Actions triggers, IPC sockets. Produces reports/entry-points.md.
| name | secrets-hunter |
| description | Find credentials, API keys, tokens, private keys, and high-entropy strings in target/. Combines gitleaks, trufflehog, detect-secrets, ggshield, and manual entropy grep. Triages each hit for live vs. test vs. revoked. |
| license | MIT (ZONOVA RESEARCH — coldvault.dev) |
# 1. gitleaks — rules are pattern-based, fast, covers git history too
gitleaks detect --source target --no-git --report-format sarif \
--report-path reports/secrets-gitleaks.sarif
gitleaks detect --source target --report-format sarif \
--report-path reports/secrets-gitleaks-history.sarif || true
# 2. trufflehog — can verify AWS / GitHub / Slack / Stripe tokens against the
# provider's API. DISABLE verification unless the analyst opts in, to avoid
# telemetry / beacons.
trufflehog filesystem target --json --no-verification > reports/secrets-trufflehog.json
# 3. detect-secrets — Python-first, lower FP rate for private keys
detect-secrets scan target > reports/secrets-detect.json
# 4. ggshield — GitGuardian rules (very broad)
ggshield secret scan path -r --json target > reports/secrets-ggshield.json || true
For every candidate secret:
| Signal | Severity |
|---|---|
| Matches a real regex + high entropy + in a non-test path | HIGH |
| Matches a real regex + in a test / example | LOW (report anyway) |
Verified live (trufflehog --verification) | CRITICAL |
| In git history but not in HEAD | MEDIUM (rotation still required) |
.env.example, fake-looking | INFO (don't report) |
ghp_…), GitLab tokens, SSH private keys (-----BEGIN …).npmrc //registry.npmjs.org/:_authToken~/.docker/config.jsontrufflehog --only-verified without --no-verification)
without explicit analyst consent — it can tip off the attacker (telemetry),
and can cost real money on some providers.reports/ — redact to first/last
4 chars: ghp_ABCD…WXYZ.reports/ (enforced by .gitignore).