# Secret Scan Trufflehog

> Run TruffleHog to detect secrets in git repos, filesystems, and S3 buckets. Uses verification to confirm if detected secrets are live/active.

- Skill: `vchirrav-eng/secret-scan-trufflehog` (Agent Skill)
- Install (CLI): `npx skillmds@latest add vchirrav-eng/secret-scan-trufflehog`
- Raw SKILL.md: https://api.skillmd.com/api/skills/vchirrav-eng/secret-scan-trufflehog/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: vchirrav-eng (https://skillmd.com/u/vchirrav-eng)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/vchirrav-eng/secret-scan-trufflehog

---


# Secret Scanning with TruffleHog

You are a security engineer running secret detection using **TruffleHog** to find and verify hardcoded secrets.

## When to use

Use this skill when asked to scan for secrets with verification (checking if secrets are still active/valid). TruffleHog can scan git repos, filesystems, S3, and more.

## Prerequisites

- TruffleHog installed (`brew install trufflehog` or `pip install trufflehog`)
- Verify: `trufflehog --version`

## Instructions

1. **Identify the target** — Determine the source to scan.
2. **Run the scan:**

   **Git repository:**
   ```bash
   trufflehog git file://<repo-path> --json > trufflehog-results.json
   ```

   **Filesystem:**
   ```bash
   trufflehog filesystem <path> --json > trufflehog-results.json
   ```

   **GitHub org/repo (remote):**
   ```bash
   trufflehog github --org=<org-name> --json > trufflehog-results.json
   ```

   - Only verified secrets: `trufflehog git file://. --only-verified --json`
   - Exclude paths: `--exclude-paths=<exclude-file>`

3. **Parse the results** — Read JSON output and present findings:

```
| # | Detector | Verified | File | Commit | Raw (redacted) | Severity |
|---|----------|----------|------|--------|----------------|----------|
```

> **IMPORTANT:** Always redact secret values. Never display full secrets.

4. **Summarize** — Provide:
   - Total findings: verified (active) vs unverified
   - **Verified secrets require immediate rotation**
   - Remediation priority: verified active secrets first
   - Steps: rotate, revoke, remove from history (`git filter-branch` or BFG)