Agent Skills › instructa/agent-skills › secleak-check

secleak-check

GitHub

用于扫描代码仓库中的密钥泄露、依赖漏洞及配置错误。支持使用 BetterLeaks 和 Trivy 工具进行安全检测，并提供添加秘密泄露防护护栏、CI 集成及 Git 钩子的设置指南。

skills/security/secleak-check/SKILL.md instructa/agent-skills

触发场景

扫描泄露的密钥检查依赖漏洞检测配置错误添加秘密泄露防护护栏发布前运行安全检查

安装

npx skills add instructa/agent-skills --skill secleak-check -g -y

更多选项

非标准路径

npx skills add https://github.com/instructa/agent-skills/tree/main/skills/security/secleak-check -g -y

不安装直接使用

npx skills use instructa/agent-skills@secleak-check

指定 Agent (Claude Code)

npx skills add instructa/agent-skills --skill secleak-check -a claude-code -g -y

安装 repo 全部 skill

npx skills add instructa/agent-skills --all -g -y

预览 repo 内 skill

npx skills add instructa/agent-skills --list

SKILL.md

Frontmatter

{
    "name": "secleak-check",
    "description": "Run or install repo security leak checks with BetterLeaks and Trivy. Use when asked to scan for leaked secrets, vulnerable dependencies, misconfigurations, add secret-leak guardrails, add BetterLeaks, add forbidden-path hooks, or run secleak-check before release."
}

Secleak Check

Workflow

Confirm cwd and repo root.
For a scan request, run the bundled script from this skill, not a target-repo script.
For a setup request, add repo-local guardrails from references/guardrails.md.
Quote exact failing tool output, but never print raw secret values.
If the bundled script is unavailable, use the manual fallback commands below.

Bundled command

Resolve scripts/secleak-check.sh relative to this SKILL.md.

Common installed path:

/Users/kregenrek/.agents/skills/secleak-check/scripts/secleak-check.sh

Manual fallback

betterleaks git --no-banner --redact=100 .
trivy fs --scanners vuln,secret,misconfig --exit-code 1 .

Prefer .betterleaks.toml when present. If only .gitleaks.toml exists, pass --config .gitleaks.toml; BetterLeaks supports it for compatibility.

Reporting

betterleaks findings are blockers until verified false-positive or remediated.
For historical leaks, report file, line, commit, rule, and fingerprint only.
trivy dependency vulnerabilities should be summarized by severity and top fixed versions.
Misconfig findings inside node_modules are dependency artifact noise unless that file is built or shipped by the repo.

Guardrail setup

When asked to harden a repo against secret leaks:

Inventory existing .betterleaks.toml, .gitleaks.toml, secret-scan workflows, Dependabot, and hook tooling.
Add .forbidden-paths.regex and a staged-file hook.
Add .betterleaks.toml with path-based filters only for fixtures.
Add repo-local scripts/secleak-check.sh only when the repo wants a first-class local script.
Add CI secret scanning and Dependabot when GitHub Actions are in scope.
Update .gitignore for runtime dirs, env files, credentials, keys, and infra state.