Results for “secret-detection”

Scans codebases for security vulnerabilities by reasoning about code context, data flow, and component interactions, covering injection flaws, secrets exposure, authentication issues, and weak cryptography across multiple languages.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Configure and manage GitHub secret scanning, push protection, custom patterns, and alert remediation.

Hunt for spearphishing campaign indicators across email logs, endpoint telemetry, and network data to detect targeted email attacks.

Hunt for Mimikatz execution using command-line patterns, LSASS access signatures, binary indicators, and in-memory detection of known modules.

Detects DNS tunneling by computing Shannon entropy of DNS query names, analyzing query length distributions, inspecting TXT record payloads, and identifying high subdomain cardinality using scapy for packet capture analysis.

Detect and extract hidden data embedded in images, audio, and other media files using steganalysis tools to uncover covert communication channels.

Detect insider threat behavioral indicators including unusual data access, off-hours activity, mass file downloads, privilege abuse, and resignation-correlated data theft.

Detects lateral movement techniques including Pass-the-Hash, PsExec, WMI execution, RDP pivoting, and SMB-based spreading using SIEM correlation of Windows event logs, network flow data, and endpoint telemetry mapped to MITRE ATT&CK Lateral Movement (TA0008) techniques.

Detect env secret detector operations. Auto-activating skill for Security Fundamentals. Triggers on: env secret detector, env secret detector Part of the Security Fundamentals skill category. Use when working with env secret detector functionality. Trigger with phrases like "env secret detector", "env detector", "env".

Conduct passive OSINT reconnaissance on target organizations using a MITRE ATT&CK framework. Discovers employees, email patterns, subdomains, infrastructure, leaked credentials, and cloud assets with confidence-scored findings.

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment.

Detect privilege escalation attempts including token manipulation, UAC bypass, unquoted service paths, kernel exploits, and sudo/doas abuse across Windows and Linux.

Detect C2 beaconing patterns in network traffic using frequency analysis, jitter detection, and domain reputation to identify compromised endpoints communicating with adversary infrastructure.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Detect data staging activity before exfiltration by monitoring for archive creation with 7-Zip/RAR, unusual temp folder access, large file consolidation, and staging directory patterns via EDR and process telemetry.

Hunt for Volume Shadow Copy deletion activity that indicates ransomware preparation or anti-forensics by monitoring vssadmin, wmic, and PowerShell shadow copy commands.

Detect Kerberoasting attacks by monitoring for anomalous Kerberos TGS requests targeting service accounts with SPNs for offline password cracking.

Detect and defend against prompt injection hidden in documents, web pages, and images consumed by an agent.

Deploys deception technology including honeypots, honeytokens, and decoy systems to detect attackers who have bypassed perimeter defenses, providing high-fidelity alerts with near-zero false positive rates.

Detect poisoned training data and backdoored models across the ML pipeline using statistical analysis, activation clustering, and spectral signatures.

Collects publicly available information about a target organization to identify attack surfaces, social engineering targets, technology stacks, and credential exposures for authorized security testing.

Detects defense evasion techniques in endpoint logs, including log tampering, timestomping, process injection, and security tool disabling, using Sysmon, EDR telemetry, and SIEM queries.

Detects early-stage ransomware indicators in network traffic before encryption begins, using Zeek, Suricata, Arkime, SIEM correlation rules, and threat intelligence feeds to identify Cobalt Strike beacons, Mimikatz signatures, and RDP brute-force attempts.

Detect suspicious PowerShell execution patterns including encoded commands, download cradles, AMSI bypass attempts, and constrained language mode evasion.

Scan text or a file for accidentally committed secrets (API keys, tokens)

Use this skill for secret inventory, env vars, rotation plans, safe dev/prod separation, leak response. Trigger when the task involves security work related to Secrets Env Rotation, implementation, audits, debugging, strategy, or validation.

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

Proactively hunt for threats by analyzing IOCs, detecting behavioral anomalies in telemetry, and prioritizing signals mapped to MITRE ATT&CK.

Enumerate subdomains of target domains using ProjectDiscovery's Subfinder passive reconnaissance tool to map the attack surface during security assessments.

Detect and exploit blind Server-Side Request Forgery vulnerabilities using out-of-band techniques, DNS interactions, and timing analysis to access internal services and cloud metadata endpoints.