Name: testland/gitleaks-scanning
Rating: 72.8 (1 reviews)
Author: testland

testland/gitleaks-scanning

Configures and runs gitleaks - Go-based secret scanner with `gitleaks git` (scan local git via `git log -p`), `gitleaks dir` (filesystem), `gitleaks stdin` (pipe); 100+ built-in rules + custom rules in `.gitleaks.toml` ([[rules]] with regex / entropy / keywords / tags); allowlist via [[rules.allowlists]] (commits / paths / stopwords); pre-commit hook + GitHub Action integration; plus baseline management for legacy debt - onboarding a repo with historical findings via `--baseline-path` snapshots, `.gitleaksignore`, cross-tool suppression consistency with TruffleHog, and rot-prevention cadence. Use when the team needs OSS secret scanning at commit time + CI gate, or is adopting scanning on a repo with pre-existing findings.

Quality

91%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Low

Low-risk findings worth noting

Quality

Content

86%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, highly actionable skill body with executable code throughout and clean progressive disclosure into two existing reference files. Its only weakness is a minor conciseness trim and the lack of an explicit validation feedback loop around the destructive history-rewrite step.

Suggestions

Add an explicit validate→fix→retry loop around the optional git history rewrite in Step 8 (e.g. 're-run gitleaks git after scrub; only mark resolved when 0 new findings'), since rewriting history is destructive.

Tighten the Worked example and prose asides (e.g. the 'git history is permanent (mirrored in clones...)' sentence) to recover token budget without losing the safety point.

Consider moving the full Worked example into references/ to keep SKILL.md a lean overview, since the anti-patterns table already conveys the same failure modes.

Dimension	Reasoning	Score
Conciseness	Mostly efficient and assumes Claude's competence (no 'what is a secret scanner' preamble), but a few prose asides like 'git history is permanent (mirrored in clones, GitHub forks, archives)' and the multi-paragraph worked example could be trimmed.	4 / 5
Actionability	Copy-paste-ready install commands, scan invocations, a complete .gitleaks.toml skeleton, pre-commit YAML, and CI workflow YAML cover the common cases with executable, specific guidance.	5 / 5
Workflow Clarity	An explicit 8-step sequence with cross-references, a Re-review-date/quarterly-audit checkpoint, and an anti-patterns checklist provide clear sequencing; however no explicit validate→fix→retry feedback loop is stated for the optional destructive history-rewrite, leaving a minor validation gap.	4 / 5
Progressive Disclosure	SKILL.md is a clear overview that pushes detail to two real one-level-deep reference files (custom-rules-and-triage.md, baseline.md), each clearly signaled with inline context and markdown links; both referenced files exist.	5 / 5
	Total	18 / 20 Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A dense, highly specific description that covers capabilities, triggers, and a clear use-when clause in third person. It earns top marks on specificity, completeness, and distinctiveness, with only minor synonym/extension gaps keeping trigger term quality at 4.

Dimension	Reasoning	Score
Specificity	Lists multiple concrete actions across all scanning modes (git/dir/stdin), custom rule authoring in .gitleaks.toml, allowlists, pre-commit + GitHub Action integration, and baseline management — comprehensive coverage with no vague padding.	5 / 5
Completeness	Explicitly states both what ('Configures and runs gitleaks...') and when ('Use when the team needs OSS secret scanning at commit time + CI gate, or is adopting scanning on a repo with pre-existing findings.') with concrete trigger phrasing.	5 / 5
Trigger Term Quality	Natural trigger phrases like 'secret scanning at commit time', 'CI gate', 'pre-commit hook', and 'pre-existing findings' map to what a team would actually say; a few synonyms (e.g. 'leaked credentials', 'API keys') and the .gitleaks.toml file extension are absent.	4 / 5
Distinctiveness Conflict Risk	Scoped to gitleaks with tool-specific triggers (gitleaks git/dir/stdin, .gitleaks.toml, --baseline-path); the TruffleHog mention is positioned as a sister scanner for cross-checking, not an overlapping trigger, so conflict risk is minimal.	5 / 5
	Total	19 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

19 days ago

Table of Contents

Discovery Implementation Validation