From enterprise-harness-engineering
Performs local workspace and Git history secret scanning, remote repository scans, pre-commit integration, and single-credential verification using TruffleHog CLI.
npx claudepluginhub addxai/enterprise-harness-engineering --plugin enterprise-harness-engineeringThis skill uses the workspace's default tool permissions.
Unified entry point Skill for TruffleHog CLI in this repository.
agents/openai.yamlreferences/credential-types.mdreferences/credential-verify.mdreferences/install-and-baseline.mdreferences/local-scan.mdreferences/pre-commit.mdreferences/remote-repo-scan.mdreferences/trufflehog-jsonl-format.mdscripts/install-trufflehog.ps1scripts/install-trufflehog.shscripts/pre-commit-trufflehog.shIntegrates gitleaks and trufflehog into CI/CD pipelines to scan git repos and filesystems for leaked secrets like API keys and tokens, blocking high-severity deployments.
Integrates gitleaks and trufflehog into CI/CD pipelines to scan git repos for leaked secrets, parse reports, and block deployments on high-severity findings.
Detects leaked secrets, API keys, passwords, and tokens in git repositories using gitleaks. Automatically sets up pre-commit hooks to scan staged files and block commits containing secrets.
Share bugs, ideas, or general feedback.
Unified entry point Skill for TruffleHog CLI in this repository.
Load modules on demand:
For reproducible, auditable installation workflows, use the built-in scripts:
For pre-commit, use the built-in wrapper script:
Treat this Skill as the company's standard operating manual for TruffleHog CLI.
It covers four primary workflows:
Do not extend this Skill into general-purpose SAST, dependency vulnerability scanning, or code auditing.
Read install-and-baseline.md first.
Baseline rules apply to all workflows:
--no-update by defaultRedacted output; raw secret values must never be printedDetermine the task type first, then load the corresponding reference:
Do not load all references at once by default.
Choose the command family based on the actual scan scope:
trufflehog filesystem .: current workspace filestrufflehog git file://...: local repository historytrufflehog git <https-repo-url>: remote repository historytrufflehog analyze: only when an interactive TUI session is availableDo not force the same command onto every scenario.
Follow least-privilege for credentials:
read_repositoryread_api/api when GitLab API-level verification is needed (e.g., PAT self-check)Every result summary must include:
verified vs unknown findings--branch, --since-commit, --max-depth)Do not claim coverage of branches that were not explicitly scanned.
User says “scan the repo,” and I run a generic command, write JSON to the repo root,
output plaintext secrets, and conclude “all branches are clean.”
Problems:
Confirm version, installation, and output strategy per the unified baseline first,
then select a single workflow with its corresponding command;
artifacts go to a temp directory, and the report clearly states what was and was not covered.
Strengths: