# Secret Guard

> Secret scanning wrapper for repositories and skill configs.

- Skill: `sahit-sai/secret-guard` (Agent Skill, multi-file: 7 files)
- Install (CLI): `npx skillmds@latest add sahit-sai/secret-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/sahit-sai/secret-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: sahit-sai (https://skillmd.com/u/sahit-sai)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/sahit-sai/secret-guard

---


# secret-guard

## Purpose

Secret scanning wrapper for repositories and skill configs.

## Runbook

1. Run `scripts/scan.sh [TARGET_PATH]` (default: current directory).
2. The script attempts to use `gitleaks` if available, else falls back to `trufflehog`, else uses built-in regex patterns.
3. Scan scope includes git-tracked files, `SKILL.md` files, `.env` files, and shell scripts.
4. Findings are written to `secret-findings.json`.
5. Run `scripts/report.sh` to produce a markdown summary of findings with remediation guidance.
6. Never print secret values; truncate matched strings to the first 6 characters plus `***`.

## Stop conditions

1. Abort if `TARGET_PATH` does not exist.
2. Abort if no scanning tool is available and the built-in regex scan also fails.
3. Never write secret values to disk or logs; always mask.
4. Abort if the active variant is unsupported.

## Output format

- `secret-findings.json` — findings: `[{tool, file, line, rule_id, severity, masked_value}]`
- Console: markdown summary with finding count by severity and remediation steps

## Example invocations

- `bash skills/secret-guard/scripts/scan.sh .`
- `bash skills/secret-guard/scripts/scan.sh /path/to/repo`
- `bash skills/secret-guard/scripts/report.sh secret-findings.json`
- "Scan this repository for accidentally committed secrets."