CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/trufflehog-scanning

Configures and runs TruffleHog v3 - secret scanner with **live verification** (validates discovered secrets against provider APIs to confirm actual exposure vs entropy false positive); supports per-source subcommands (`git`, `github`, `gitlab`, `filesystem`, `s3`, `docker`, `gcs`, `postman`); `--results=verified` filter for high-precision output; `--exclude-detectors=TYPE` for noise reduction; exits 183 on findings via `--fail`. Use when the team needs verified secret findings (low false-positive rate) or scans across cloud + repo + container surfaces.

72

Quality

90%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

88%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced skill body with strong validation checkpoints and copy-paste-ready examples. The main weakness is length: ~260 lines inlined in SKILL.md with no reference files to offload detailed YAML configs and triage tables.

Suggestions

Move the full trufflehog.yaml example, the justification template, and the pre-commit/CI YAML into a references/ file (e.g. references/ci-configs.md), keeping SKILL.md as a lean overview.

Tighten the Step 3 verification-flow prose to remove the 'looks like an AWS key' explanatory framing Claude already understands.

Trim the inlined subcommand table if the same detail is derivable from `trufflehog --help`.

DimensionReasoningScore

Conciseness

Mostly efficient and focused on TruffleHog-specific behavior Claude wouldn't know (verification flow, flag trade-offs, exit codes); minor over-explanation in the verification-flow prose and false-positive framing could be trimmed. Not a 5 because a few explanatory passages pad the body.

4 / 5

Actionability

Provides fully executable, copy-paste-ready guidance: install commands, per-source subcommand examples, trufflehog.yaml config, pre-commit hook, and GitHub Action workflow with concrete args. Common cases are covered with specific commands.

5 / 5

Workflow Clarity

Clear sequenced Steps 1-8 with explicit validation checkpoints: mandatory false-positive triage (Step 5), exit-code 183 semantics (Step 6), mandatory REASONS justification template, and CI gating via --fail. Batch scanning includes feedback loops for error recovery.

5 / 5

Progressive Disclosure

Well-organized single-file skill with clear section headers and one-level-deep references to sister skills, but no bundle files exist and ~260 lines inline content (full YAML examples, anti-patterns table, limitations) that could be split into references files. Good structure with minor organization gaps.

4 / 5

Total

18

/

20

Passed

Description

88%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, specific description that covers what TruffleHog does and when to use it with concrete trigger guidance. Minor gap is missing common synonyms for 'secrets' that users would naturally say.

Suggestions

Add common user-facing synonyms to the trigger clause, e.g. 'leaked secrets, credentials, or API keys', so it matches natural phrasing.

Consider noting the gitleaks-scanning boundary inline to sharpen distinctiveness from the sister skill.

DimensionReasoningScore

Specificity

Lists multiple concrete actions and flags: 'Configures and runs', 'validates discovered secrets against provider APIs', per-source subcommands (git, github, s3, docker...), '--results=verified filter', '--exclude-detectors=TYPE', 'exits 183 on findings via --fail'. Comprehensive coverage of the tool's capabilities.

5 / 5

Completeness

Explicitly answers both 'what' (configures/runs TruffleHog with verification, subcommands, filters, exit codes) and 'when' via the concrete 'Use when the team needs verified secret findings... or scans across cloud + repo + container surfaces' trigger clause.

5 / 5

Trigger Term Quality

Includes natural terms like 'verified secret findings', 'low false-positive rate', and 'scans across cloud + repo + container surfaces', but misses common synonyms a user might say such as 'leaked secrets', 'credentials', or 'API keys'. Good coverage with a few natural terms missing.

4 / 5

Distinctiveness Conflict Risk

Occupies a clear niche (TruffleHog v3, live verification) with distinct triggers; only minor overlap risk with the sister gitleaks-scanning skill, which is explicitly called out as a layering partner.

4 / 5

Total

18

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents

DiscoveryImplementationValidation