git-secrets-scanner

What This Skill Does

The git-secrets-scanner is an advanced OpenClaw agent skill designed to proactively identify and prevent the leakage of sensitive data within Git repositories. By integrating tools like Gitleaks, TruffleHog, and git-secrets, this agent acts as a security guard for your codebase. It scans commits, local files, and historical logs to detect hardcoded API keys, database credentials, SSH private keys, JWT tokens, and OAuth secrets. This automated approach ensures that developers catch security vulnerabilities before they are pushed to remote servers, effectively reducing the risk of data breaches and unauthorized access.

Installation

To integrate this security tool into your OpenClaw environment, use the command: clawhub install openclaw/skills/skills/guohongbin-git/git-secrets-scanner. Ensure you have Git installed on your system. Depending on your choice of scanning engine, you may need to install the underlying binary via Homebrew (e.g., brew install gitleaks) or Go (go install github.com/gitleaks/gitleaks/v8@latest). Once the skill is installed, the agent will have the permissions required to traverse your file system and execute scanning commands against your repository structure.

Use Cases

This skill is essential for individual developers, DevOps engineers, and security teams. Use it to scan new repositories for existing vulnerabilities, set up pre-commit hooks that block commits containing secrets, or perform bulk audits across hundreds of projects. It is particularly valuable during CI/CD pipelines where automated security gates are necessary to maintain compliance and protect corporate infrastructure from accidental credential exposure.

Example Prompts

1. "OpenClaw, please scan the current directory for any exposed AWS secret keys or database connection strings using Gitleaks."
2. "I need to audit the entire commit history of my current repository for any leaked secrets. Run a deep scan and provide a summary report."
3. "Help me set up a pre-commit hook in this project to prevent anyone from accidentally pushing .env files or API keys in the future."

Tips & Limitations

While the scanner is highly effective, it is not infallible. Always prioritize manual verification of results to avoid false positives. It is recommended to use specific rulesets tailored to your environment rather than broad scans. Furthermore, remember that scanning a repository does not delete the secret from Git history; you must follow up by revoking compromised credentials and using tools like BFG or filter-repo to scrub sensitive data from your repository's commit logs entirely.