CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/kingfisher-scanning

Configures and runs Kingfisher for secret scanning with access mapping: discovers leaked credentials AND maps them to the IAM identities and cloud resources they expose (S3 buckets, RDS instances, etc.); Intel Hyperscan regex engine makes it the fastest option for large monorepos; 950 built-in rules (largest of the OSS scanners); multi-target (local files / Git history / GitHub / GitLab / AWS S3 / Docker images); live API validation plus offline checksum verification; suppression via `--skip-regex` / `--skip-word` / `--baseline-file` / inline `kingfisher:ignore`. Use when cloud-blast-radius context matters or scan time on a large repo is blocking. Front-loads access-mapping and Hyperscan speed to differentiate from trufflehog-scanning, which also does multi-target scanning and live validation but offers no IAM access mapping.

75

Quality

94%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

85%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A well-structured, actionable skill body with concrete commands, clear multi-step workflow, and explicit validation feedback loops for batch scanning. The only weakness is conciseness: the Overview and Steps 3-4 duplicate capability statements and Kingfisher taglines already in the description.

Suggestions

Trim the Overview and Steps 3-4 to avoid restating the 950-rules / Hyperscan / access-mapping capabilities already in the description; reference them once and move on.

Remove the re-quoted Kingfisher taglines ('Confirms discovered secrets against provider APIs...', 'Maps discovered credentials...') since they duplicate the description; keep only the operational guidance.

Consolidate the repeated 'Per [kf-gh]' attribution cues so the body reads as instructions rather than a sequence of citations.

DimensionReasoningScore

Conciseness

The body is mostly lean command snippets and tables, but the Overview and Steps 3-4 restate capabilities ('950 built-in rules', Hyperscan, access mapping) and re-quote Kingfisher taglines already present in the description, so it could be tightened; not verbose enough for a 1 but not fully lean.

2 / 3

Actionability

Provides fully executable, copy-paste-ready guidance throughout — install commands, `kingfisher scan` invocations, CI YAML, baseline workflow, and an inline `kingfisher:ignore` example — matching the 'fully executable code/commands; copy-paste ready' anchor.

3 / 3

Workflow Clarity

A clear seven-step sequence with explicit validation/feedback loops for this batch scanning task: baseline diff so only NEW findings fail, verified-only CI gating, a mandatory justification template, and a quarterly audit cadence.

3 / 3

Progressive Disclosure

Well-organized into Overview, When-to-use, numbered steps, Anti-patterns, Limitations, and References; no bundle files exist so all content is self-contained, and the cited references ([kf-gh], sister skills) are one level deep and clearly signaled with no nested indirection.

3 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, third-person description that concretely states capabilities, includes explicit 'Use when' triggers, and clearly differentiates from the overlapping trufflehog-scanning skill. Minor weakness is the differentiating tail reads as model-routing guidance rather than user-natural language, but all four dimensions score at the top anchor.

DimensionReasoningScore

Specificity

Names multiple concrete actions ('Configures and runs Kingfisher', 'discovers leaked credentials AND maps them to the IAM identities and cloud resources', 'live API validation plus offline checksum verification', 'suppression via --skip-regex / --skip-word'), matching the 'lists multiple specific concrete actions' anchor.

3 / 3

Completeness

Explicitly answers both what (configures/runs scanning with access mapping and listed features) and when via 'Use when cloud-blast-radius context matters or scan time on a large repo is blocking', matching the clear-what-and-when-with-explicit-triggers anchor.

3 / 3

Trigger Term Quality

Includes natural user-facing terms like 'secret scanning', 'leaked credentials', and 'scan time on a large repo', giving good coverage of phrases a user would actually say; the Hyperscan/IAM tail is routing guidance but the core triggers are well covered.

3 / 3

Distinctiveness Conflict Risk

Explicitly carves a distinct niche ('Front-loads access-mapping and Hyperscan speed to differentiate from trufflehog-scanning, which also does multi-target scanning and live validation but offers no IAM access mapping'), making it unlikely to trigger for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents