CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/trufflehog-scanning

Configures and runs TruffleHog v3 - secret scanner with **live verification** (validates discovered secrets against provider APIs to confirm actual exposure vs entropy false positive); supports per-source subcommands (`git`, `github`, `gitlab`, `filesystem`, `s3`, `docker`, `gcs`, `postman`); `--results=verified` filter for high-precision output; `--exclude-detectors=TYPE` for noise reduction; exits 183 on findings via `--fail`. Use when the team needs verified secret findings (low false-positive rate) or scans across cloud + repo + container surfaces.

77

Quality

97%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Low

Low-risk findings worth noting

Overview
Quality
Evals
Security
Files

Quality

Content

92%

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A highly actionable, well-sequenced scanning skill with executable commands and validation gating throughout. The main weakness is progressive disclosure: it is a long monolithic SKILL.md that keeps all detail inline rather than splitting deeper material into reference files.

Suggestions

Move the detailed CI/pre-commit integration (Step 7) and the full trufflehog.yaml example (Step 5) into a references/ file (e.g. references/ci-integration.md) linked from a concise summary, so SKILL.md stays an overview.

Reduce the repeated 'Per [th-gh][th-gh]' annotations - define the source link once and drop the per-section citations to tighten the body.

Consider extracting the per-source subcommand examples into a references/subcommands.md table and keeping only the most common (git/github/filesystem) inline.

DimensionReasoningScore

Conciseness

The body is dense with executable commands, flag tables, and configs and assumes Claude's competence (no explaining what git/S3/Docker are); the only minor noise is the repeated 'Per [th-gh]' link annotations and a little explanatory prose in Step 3.

3 / 3

Actionability

Fully executable, copy-paste-ready guidance throughout - install commands, per-source scan invocations, trufflehog.yaml config, pre-commit hook, and a complete GitHub Action with PR diff flags.

3 / 3

Workflow Clarity

A clear numbered sequence (Install -> subcommands -> verification -> output -> triage -> failure semantics -> CI -> layering) with validation checkpoints: the '--fail'/exit-183 gating and the mandatory false-positive triage with justification template serve as explicit feedback loops.

3 / 3

Progressive Disclosure

Sections are well organized but the skill is a single monolithic file with no bundle/reference files and no one-level-deep local references; content such as the full CI integration and trufflehog.yaml examples could be split into separate reference files for a skill of this length.

2 / 3

Total

11

/

12

Passed

Description

100%

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, dense description using third-person voice that conveys concrete capabilities and an explicit 'Use when' trigger. It is borderline verbose but the length is earned by specific, non-generic detail rather than fluff.

DimensionReasoningScore

Specificity

Lists multiple concrete actions and capabilities - 'Configures and runs TruffleHog v3', 'validates discovered secrets against provider APIs', per-source subcommands (git/github/gitlab/s3/docker/...), '--results=verified', '--exclude-detectors', and 'exits 183 on findings via --fail'.

3 / 3

Completeness

Clearly answers both what (configures/runs TruffleHog with live verification, subcommands, filters, exit semantics) and when via the explicit 'Use when the team needs verified secret findings ... or scans across cloud + repo + container surfaces' trigger clause.

3 / 3

Trigger Term Quality

Natural terms a user would say are well covered - 'secret scanner', 'verified secret findings', 'low false-positive rate', 'scans across cloud + repo + container surfaces' - rather than only technical jargon.

3 / 3

Distinctiveness Conflict Risk

Occupies a clear niche (live-verified secret scanning across cloud/repo/container surfaces) and is explicitly contrasted with sister scanners, making it unlikely to trigger for the wrong skill.

3 / 3

Total

12

/

12

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents