# Trufflehog

> Use for repository, filesystem, and remote source secret discovery during authorized pentests. Trigger on secret hunting, token exposure review, and validating whether approved code or history contains material credential leakage.

- Skill: `timsonner/trufflehog` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/trufflehog`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/trufflehog/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/trufflehog

---


# TruffleHog

## Purpose

Use this skill when the engagement needs broader secret discovery across approved repositories, filesystems, or version history.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to inspect approved code or history for token or credential exposure.
- Need deeper secret discovery than a simple working-tree scan.
- Need a repeatable retest after cleanup.

## Avoid When

- The repository or history is out of scope.
- Secret-handling rules are unclear.

## Inputs

- Approved target repository or filesystem path
- Scan mode and evidence redaction requirements
- Boundaries on remote history or archive review

## Procedure

1. Confirm that the target path or repository is approved.
2. Scope the scan to the minimum history or content needed.
3. Triage findings for material active secrets.
4. Redact raw secret values from evidence where possible.
5. Preserve the exact scan scope for retest.

## Command Syntax

Replace sample paths with approved in-scope repositories.

```bash
# Scan a local git repository
trufflehog git file:///path/to/contoso-repo --json > contoso-trufflehog.json

# Scan a specific branch
trufflehog git file:///path/to/contoso-repo --branch main

# Only output verified secrets (reduce false positives)
trufflehog git file:///path/to/contoso-repo --only-verified

# Scan a filesystem directory
trufflehog filesystem /path/to/contoso-code/ --json

# Scan an S3 bucket
trufflehog s3 --bucket=contoso-prod-backup

# Include all detector types
trufflehog git file:///path/to/contoso-repo --include-detectors all
```

## Evidence to Capture

- Confirmed secret exposure with repository or history context
- Whether the issue appears current or historical
- Exact scan mode and target used

## Safety Boundaries

- Redact or minimize raw secret material in notes and reports.
- Do not use exposed credentials beyond the explicit engagement scope.