testland/trufflehog-scanning
Configures and runs TruffleHog v3 - secret scanner with **live verification** (validates discovered secrets against provider APIs to confirm actual exposure vs entropy false positive); supports per-source subcommands (`git`, `github`, `gitlab`, `filesystem`, `s3`, `docker`, `gcs`, `postman`); `--results=verified` filter for high-precision output; `--exclude-detectors=TYPE` for noise reduction; exits 183 on findings via `--fail`. Use when the team needs verified secret findings (low false-positive rate) or scans across cloud + repo + container surfaces.
72
90%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Low
Low-risk findings worth noting
Low
Low-risk findings.
1 low severity finding. Worth noting, but not necessarily harmful.
W011: Third-party content exposure detected (indirect prompt injection risk).
What this means
The skill exposes the agent to untrusted, user-generated content from public third-party sources, creating a risk of indirect prompt injection. This includes browsing arbitrary URLs, reading social media posts or forum comments, and analyzing content from unknown websites.
Why it was flagged
SKILL.md describes TruffleHog’s required runtime workflow as scanning user-selected sources (e.g., `trufflehog github` for GitHub orgs/repos, or other subcommands like `postman`, `s3`, etc.) where an outsider can submit free text into those items and the tool will ingest and scan it for secrets.
Where we found it
GitHub repos/orgs scanned via `trufflehog github`
content-type · 4 sites
The plugin instructs the agent to scan GitHub orgs/repos via `trufflehog github`, ingesting repository content where outsiders can submit PRs, issues, and commits containing attacker-controlled text that appears in scan output processed by the agent.
SKILL.md
62
| `github` | GitHub orgs / repos (live API scan) |
SKILL.md
77
trufflehog github --org=trufflesecurity --results=verified --json
SKILL.md
44
github --repo https://github.com/trufflesecurity/test_keys
SKILL.md
27
Scanning beyond git: GitHub orgs, GitLab repos, S3 buckets,
GitLab repos scanned via `trufflehog gitlab`
content-type · 2 sites
The plugin instructs the agent to scan GitLab repositories via `trufflehog gitlab`, ingesting repository content where outsiders can contribute code containing attacker-controlled text that appears in scan output processed by the agent.
SKILL.md
63
| `gitlab` | GitLab repositories |
SKILL.md
27
Scanning beyond git: GitHub orgs, GitLab repos, S3 buckets,
Git repositories scanned via `trufflehog git`
content-type · 4 sites
The plugin instructs the agent to scan git repositories (local or remote) via `trufflehog git`, ingesting full commit history where outsiders may have contributed content containing attacker-controlled text that appears in scan output.
SKILL.md
61
| `git` | Local Git repositories (full history) |
SKILL.md
74
trufflehog git https://github.com/trufflesecurity/test_keys --results=verified
SKILL.md
119
trufflehog git . --json --results=verified > verified-secrets.json
SKILL.md
184
trufflehog git . --results=verified --fail
S3 buckets scanned via `trufflehog s3`
content-type · 2 sites
The plugin instructs the agent to scan AWS S3 buckets via `trufflehog s3`, ingesting bucket content where outsiders may have uploaded files containing attacker-controlled text that appears in scan output.
SKILL.md
65
| `s3` | AWS S3 buckets |
SKILL.md
27
Scanning beyond git: GitHub orgs, GitLab repos, S3 buckets,
Docker images scanned via `trufflehog docker`
content-type · 2 sites
The plugin instructs the agent to scan Docker images via `trufflehog docker`, ingesting image layer content where outsiders may have contributed content containing attacker-controlled text that appears in scan output.
SKILL.md
66
| `docker` | Docker images (layered) |
SKILL.md
28
Docker images, Postman workspaces.
GCS buckets scanned via `trufflehog gcs`
content-type · 1 site
The plugin instructs the agent to scan Google Cloud Storage buckets via `trufflehog gcs`, ingesting bucket content where outsiders may have uploaded files containing attacker-controlled text that appears in scan output.
SKILL.md
67
| `gcs` | Google Cloud Storage |
Postman workspaces scanned via `trufflehog postman`
content-type · 2 sites
The plugin instructs the agent to scan Postman workspaces via `trufflehog postman`, ingesting workspace content where outsiders may have shared collections containing attacker-controlled text that appears in scan output.
SKILL.md
68
| `postman` | Postman workspaces |
SKILL.md
28
Docker images, Postman workspaces.
- Audited
- Security analysis