Agent Skills › instructa/agent-skills › secleak-check

secleak-check

GitHub

用于扫描仓库中的泄露密钥、依赖漏洞及配置错误，或添加安全护栏。支持运行BetterLeaks和Trivy进行合规检查与修复建议。

skills/security/secleak-check/SKILL.md instructa/agent-skills

Trigger Scenarios

扫描泄露的密钥检查依赖漏洞添加秘密泄漏护栏发布前安全检查

Install

npx skills add instructa/agent-skills --skill secleak-check -g -y

More Options

Non-standard path

npx skills add https://github.com/instructa/agent-skills/tree/main/skills/security/secleak-check -g -y

Use without installing

npx skills use instructa/agent-skills@secleak-check

指定 Agent (Claude Code)

npx skills add instructa/agent-skills --skill secleak-check -a claude-code -g -y

安装 repo 全部 skill

npx skills add instructa/agent-skills --all -g -y

预览 repo 内 skill

npx skills add instructa/agent-skills --list

SKILL.md

Frontmatter

{
    "name": "secleak-check",
    "description": "Run or install repo security leak checks with BetterLeaks and Trivy. Use when asked to scan for leaked secrets, vulnerable dependencies, misconfigurations, add secret-leak guardrails, add BetterLeaks, add forbidden-path hooks, or run secleak-check before release."
}

Secleak Check

Workflow

Confirm cwd and repo root.
For a scan request, run the bundled script from this skill, not a target-repo script.
For a setup request, add repo-local guardrails from references/guardrails.md.
Quote exact failing tool output, but never print raw secret values.
If the bundled script is unavailable, use the manual fallback commands below.

Bundled command

Resolve scripts/secleak-check.sh relative to this SKILL.md.

Common installed path:

/Users/kregenrek/.agents/skills/secleak-check/scripts/secleak-check.sh

Manual fallback

betterleaks git --no-banner --redact=100 .
trivy fs --scanners vuln,secret,misconfig --exit-code 1 .

Prefer .betterleaks.toml when present. If only .gitleaks.toml exists, pass --config .gitleaks.toml; BetterLeaks supports it for compatibility.

Reporting

betterleaks findings are blockers until verified false-positive or remediated.
For historical leaks, report file, line, commit, rule, and fingerprint only.
trivy dependency vulnerabilities should be summarized by severity and top fixed versions.
Misconfig findings inside node_modules are dependency artifact noise unless that file is built or shipped by the repo.

Guardrail setup

When asked to harden a repo against secret leaks:

Inventory existing .betterleaks.toml, .gitleaks.toml, secret-scan workflows, Dependabot, and hook tooling.
Add .forbidden-paths.regex and a staged-file hook.
Add .betterleaks.toml with path-based filters only for fixtures.
Add repo-local scripts/secleak-check.sh only when the repo wants a first-class local script.
Add CI secret scanning and Dependabot when GitHub Actions are in scope.
Update .gitignore for runtime dirs, env files, credentials, keys, and infra state.