secret-audit

Procedure

1. Tooling: prefer gitleaks git --report-format json --report-path /tmp/gitleaks.json . if command -v gitleaks succeeds (detect is deprecated since gitleaks 8.19; on an older gitleaks use gitleaks detect --source .); else trufflehog git file://. --json; else fall back to grep over git log -p --all with the pattern set below.
2. Fallback pattern set (grep -E): AKIA[0-9A-Z]{16}, sk-(live|test|proj|ant)-[A-Za-z0-9_-]{16,}, gh[pousr]_[A-Za-z0-9]{30,}, xox[abpr]-, -----BEGIN [A-Z ]*PRIVATE KEY-----, eyJ[A-Za-z0-9_-]{20,}\.eyJ, (?i)(password|passwd|secret|token|api[_-]?key)\s*[:=]\s*["'][^"']{12,}["'], plus .env, *.pem, *.p12, id_rsa filenames in history: git log --all --diff-filter=A --name-only --format='' | grep -E '(^|/)(\.env|.*\.pem|.*\.p12|id_rsa)$'.
3. Deduplicate; for each finding record path | first commit (sha, date, author) | still in HEAD? | type.
4. Classify: live in HEAD (critical), only in history (high), example/test/false positive (note, no action).
5. Remediation plan, in this order, as a checklist for the user:
   1. Rotate every credential found (it is compromised once committed, even if purged).
   2. Remove from HEAD: move to env/.env (gitignored), commit.
   3. Purge history only if the repo is/will be public or shared: git filter-repo --path <file> --invert-paths or --replace-text, then force-push with --force-with-lease and tell collaborators to re-clone. Do not run this without explicit approval.
   4. Add prevention: .gitignore entries, pre-commit hook (gitleaks git --pre-commit --staged .; protect --staged on gitleaks older than 8.19), and this plugin's secret-scan hook.
6. Print the findings table and the checklist. Never print full secret values; mask to first 4 + last 2 chars. That includes notes: when a value matches a known placeholder (the AWS docs example key, a vendor's sample token), say so by name and keep the masked form, never the full string.
7. Before sending the final message, re-read the whole reply (summary, table, notes, checklist) and mask every key-shaped string that is still in full: first 4 + last 2 chars, placeholders and documentation examples included. Send only after this pass finds nothing.

Rules

• Never rewrite history or force-push in this skill; propose only.
• Never paste unmasked secrets into the transcript.

Verify

Maintainers: bash evals/run.sh /tmp/skillkeel-evals secret-audit from the plugin root runs this case and grades it; records and transcripts sit in evals/secret-audit/. evals/secret-audit/: fixture repo where a .env with a fake AWS key was committed then deleted two commits later; expected: finding reported as "only in history" with the introducing sha, value masked, rotate-first plan, no history rewrite executed.