holocron/.agents/skills/gitleaks/META.md at 345f80438e647151e802ec849e0170bd1dc712a1

Files

Defame1297 25a6a454b9 feat: add gitleaks secret scanning setup and skill

- scripts/setup-gitleaks.sh — installs gitleaks v8.24.2, seeds
  .gitleaks.toml on first run, writes managed pre-commit hook block;
  re-run replaces block in place without disturbing other hook content
- scripts/gitleaks.toml — base config template extending default ruleset
- .gitleaks.toml — repo config with docs/research/ path allowlist
  (high-entropy terminal captures; v8.24.2 [allowlist] syntax)
- tests/test-setup-gitleaks.sh — 6 behavior tests including stale-block
  replacement and idempotency
- .agents/skills/gitleaks/ — cross-cutting skill covering install,
  update, allowlist tuning, scan modes, and real-finding remediation
- .agents/evals/cross-cutting/gitleaks/eval.yaml — 7 trigger + 3 output
  tests including version-aware allowlist guidance case
- docs/spec/overview.md — updated to reflect new tooling and skill

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-06-20 11:29:10 +00:00

651 B

Raw Blame History

version: "1.0"
updated: 2026-06-20

when: >
  Invoked when the user wants to install gitleaks and wire it as a git pre-commit secret
  scanner, update the hook in an existing repo, tune allowlist rules to suppress false
  positives, debug a scan finding, or rotate a real secret that was found. Covers the full
  lifecycle: install → configure → maintain → remediate. Not invoked for general code
  security review (security-review skill) or CI pipeline secret scanning (write-ci-pipeline skill).

references:
  - https://github.com/gitleaks/gitleaks/releases/tag/v8.24.2
  - https://github.com/gitleaks/gitleaks/blob/main/README.md

651 B Raw Blame History

651 B

Raw Blame History