菜单
[static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
[exploit] Inspect and attack JSON Web Tokens — alg:none, key confusion (RS256→HS256), weak-secret cracking, claim tampering. Reach for it whenever the app authenticates with JWTs to test signature and verification flaws.
[recon] Fast SYN/CONNECT port scanner for hosts/CIDRs (Go, libpcap). Reach for it to find open ports across many hosts quickly, then hand the open services to nmap for deep fingerprinting.
[static-analysis] All-in-one scanner over the connected repo: dependency CVEs across MANY ecosystems (npm, NuGet/.NET, Maven, Go, pip, RubyGems…), plus IaC/Dockerfile/Kubernetes misconfig and a filesystem secret sweep. Reach for it in pre-recon/vuln-analysis for SCA on stacks osv-scanner under-covers and for deeper infra-misconfig than generic SAST.
[static-analysis] Static code analysis (SAST) over the connected repo — taint/pattern rules per vuln category, no live traffic. Reach for it in vuln-analysis to locate vulnerable code at file:line that DAST then confirms.
[static-analysis] Scan a repo's files and full git history for hardcoded secrets (keys, tokens, credentials). Reach for it in vuln-analysis to find committed secrets, including ones removed from HEAD but live in history.
[static-analysis] Mine the cloned repo's OWN git history for past security/fix commits and map them to recurring hot files, then fold in dependency-CVE (osv-scanner) and history-secret (gitleaks) signals. Reach for it in pre-recon to seed 'what's been exploited before' — code patched for a vuln once is the highest-yield place to re-examine.
| name | trufflehog |
| description | [static-analysis] Find secrets in a repo/history/filesystem and LIVE-VERIFY them against the issuing provider. Reach for it in vuln-analysis when you need to separate truly-active leaked credentials from dead noise. |
trufflehog (pure-Go). Like gitleaks it finds secrets across repo/history/files,
but its differentiator is verification: for many detector types it calls the
provider's API to confirm the credential is still active. Read-only on the repo →
vuln-analysis phase. Use it to prioritize gitleaks hits by "is it live".
trufflehog filesystem <path> scans files directly — works on uploads
with no .git. Make this your default.trufflehog git file:///<repo> scans history — only when .git exists.
On a .git-less upload it finds nothing; use filesystem mode instead of
concluding "no secrets".trufflehog filesystem <path> (files) or trufflehog git file:///path/to/repo (history).--only-verified report only credentials confirmed live (cuts false positives).--json structured output (one JSON object per finding).--results=verified,unknown control which verification states to emit.--since-commit <sha> / --branch <ref> bound the scan for diffs.# Default: filesystem scan (works with or without .git), verified-only, JSON out
trufflehog filesystem /path/to/repo --only-verified --json > trufflehog.jsonl
# If .git exists, ALSO sweep history:
[ -d /path/to/repo/.git ] && trufflehog git file:///path/to/repo \
--only-verified --json >> trufflehog.jsonl
verified: true credential is a high-severity confirmed finding (CWE-798);
record the redacted value + where it grants access — never the raw secret.