How does the pre-commit hook work?

The skill automatically triggers a scan of staged files using Gitleaks before a commit is finalized, blocking the action and providing remediation steps if secrets are detected.

Can I ignore known false positives?

Yes, you can generate and use a .gitleaks-baseline.json file to track and ignore acknowledged findings, ensuring they don't block future commits.

Which container runtimes are supported?

It supports Apple Container (macOS 26+), Docker, and Colima via mise, with automatic detection logic to use the best available runtime on your system.

How does this differ from the security-review skill?

The security skill is for automated scanning of secrets and keys, whereas the security-review skill is designed for architectural reviews, threat modeling, and vulnerability assessments.

Secret Detection & Credential Scanning

Name: Secret Detection & Credential Scanning
Author: vinnie357

byvinnie357

•

セキュリティとテスト

Protects repositories by automatically detecting leaked secrets, API keys, and credentials using Gitleaks integration.

This skill provides robust security for software development workflows by integrating Gitleaks for automated secret detection. It features a specialized pre-commit hook that scans staged files before every commit, preventing sensitive data like API keys, passwords, and tokens from ever entering the git history. Supporting multiple container runtimes including Apple Container, Docker, and Colima, it offers flexible deployment across different environments and integrates seamlessly into CI/CD pipelines to ensure defense-in-depth security and compliance.

主な機能

01Multi-runtime support including Apple Container, Docker, and Colima

025 GitHub stars

03Comprehensive detection of AWS keys, GitHub tokens, and private keys

04Automated pre-commit secret scanning for staged files

05Customizable detection rules via .gitleaks.toml configuration

06Baseline management to acknowledge and ignore known false positives

ユースケース

01Standardizing security checks across team development environments

02Preventing accidental commits of API keys and credentials

03Auditing existing git history for sensitive data leaks

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add vinnie357/claude-skills security

For use in Claude.ai and ChatGPT

Download Skill