testland/gitleaks-scanning
Configures and runs gitleaks - Go-based secret scanner with `gitleaks git` (scan local git via `git log -p`), `gitleaks dir` (filesystem), `gitleaks stdin` (pipe); 100+ built-in rules + custom rules in `.gitleaks.toml` ([[rules]] with regex / entropy / keywords / tags); allowlist via [[rules.allowlists]] (commits / paths / stopwords); pre-commit hook + GitHub Action integration; plus baseline management for legacy debt - onboarding a repo with historical findings via `--baseline-path` snapshots, `.gitleaksignore`, cross-tool suppression consistency with TruffleHog, and rot-prevention cadence. Use when the team needs OSS secret scanning at commit time + CI gate, or is adopting scanning on a repo with pre-existing findings.
72
91%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
2 low severity findings. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
The required workflow runs `gitleaks git` / `gitleaks dir` / `gitleaks stdin`, which ingests repository content or piped input authored by the user/attacker at runtime (e.g., PR diffs via `git diff ... | gitleaks stdin` or checked-out PR code via `actions/checkout`).
Where we found it
git repository content (history, files, diffs)
content-type · 8 sites
The plugin scans git repository content (history, directories, piped diffs) which may include attacker-controlled data such as PR diffs or checked-out PR code, exposing the agent to indirect prompt injection.
W012: Unverifiable external dependency detected (runtime URL that controls agent).
What this means
The skill fetches instructions or code from an external URL at runtime, and the fetched content directly controls the agent’s prompts or executes code. This dynamic dependency allows the external source to modify the agent’s behavior without any changes to the skill itself.
Why it was flagged
The install instructions include a runtime fetch-and-build step ("git clone https://github.com/gitleaks/gitleaks.git" followed by "make build") and a pre-commit hook that pulls the hook repo (repo: https://github.com/gitleaks/gitleaks), which fetch and execute remote code from those URLs.
Where we found it
git clone https://github.com/gitleaks/gitleaks.git
command · 1 site
The plugin instructs cloning and building gitleaks from source via git clone followed by make build, fetching and executing remote code at install time.
SKILL.md
59
git clone https://github.com/gitleaks/gitleaks.git
https://github.com/gitleaks/gitleaks
dependency · 1 site
The pre-commit hook configuration pulls and executes code from the gitleaks GitHub repository at hook install/run time.
SKILL.md
142
- repo: https://github.com/gitleaks/gitleaks
gitleaks/gitleaks-action@v2
dependency · 1 site
The CI workflow uses a GitHub Action from a third-party repository, which fetches and executes remote code in the CI environment.
SKILL.md
165
- uses: gitleaks/gitleaks-action@v2
actions/checkout@v5
dependency · 1 site
The CI workflow uses the actions/checkout GitHub Action, a hosted remote dependency that executes third-party code.
SKILL.md
163
- uses: actions/checkout@v5
zricethezav/gitleaks:latest
dependency · 2 sites
The plugin instructs pulling and running a Docker image from Docker Hub, which fetches and executes remote third-party code.
SKILL.md
55
docker pull zricethezav/gitleaks:latest
SKILL.md
56
docker run -v ${PWD}:/path zricethezav/gitleaks:latest git /path
gitleaks (brew)
dependency · 1 site
The plugin instructs installing gitleaks via Homebrew, which fetches and installs a third-party package from the Homebrew registry.
SKILL.md
52
brew install gitleaks
- Audited
- Security analysis