doro-git-secrets-scanner

What This Skill Does

The doro-git-secrets-scanner skill provides an intelligent, automated interface for identifying sensitive information leaks within git repositories. By leveraging powerful backend tools like Gitleaks, TruffleHog, and git-secrets, this agent can scan your codebase for exposed AWS keys, database passwords, OAuth tokens, and private cryptographic keys before they are committed or pushed to remote servers. The skill essentially acts as a security sentry that analyzes git history, unstaged changes, and entire repositories to ensure your secrets remain private and your infrastructure remains secure.

Installation

You can install the doro-git-secrets-scanner by running the following command in your terminal within the OpenClaw environment: clawhub install openclaw/skills/skills/a2mus/doro-git-secrets-scanner. Once installed, ensure that your environment has at least one of the supported scanning engines (Gitleaks, TruffleHog, or git-secrets) installed on your system path. If you are operating in a CI/CD environment, the skill will automatically integrate with GitHub Actions to trigger automated security audits on every push or pull request.

Use Cases

• Pre-commit Prevention: Run the scanner automatically before every commit to catch secrets before they are permanently written to your git history.
• Historical Audits: Perform a deep scan across the entire commit history of a repository to identify legacy leaks that may have occurred months or years ago.
• CI/CD Security Gates: Incorporate the scanner into your deployment pipeline to fail builds that contain hardcoded credentials.
• Multi-repo Compliance: Iterate through a collection of organizational repositories to maintain a high-level view of potential credential leakage across teams.

Example Prompts

1. "Scan the current repository for any leaked AWS access keys or hardcoded database credentials in the last 10 commits."
2. "Perform a full history scan of this project and report any findings categorized by rule ID and file path."
3. "Set up a pre-commit hook in this project to prevent anyone from pushing commits that contain .env files or secret strings."

Tips & Limitations

• False Positives: Automated scanners occasionally flag entropy-heavy strings that are not actual secrets. Review findings manually before revoking production keys.
• Performance: Scanning large repositories with extensive history may take several minutes; for initial runs, consider scanning only recent branches or specific commits.
• Cleanup: This skill detects leaks, but cleaning them requires using tools like BFG Repo-Cleaner or git-filter-repo to rewrite history. Always back up your repository before performing destructive cleanup operations.