check-secrets
Pass
Audited by Gen Agent Trust Hub on Feb 21, 2026
Risk Level: SAFE
Full Analysis
- [COMMAND_EXECUTION] (SAFE): The skill utilizes standard shell commands (
git ls-filesandgrep) to identify files for scanning. These are read-only operations on the local file system structure and do not pose a security risk as they are restricted to discovery within the user's codebase. - [DATA_EXFILTRATION] (SAFE): While the skill's primary purpose is to identify sensitive data (secrets, keys, tokens), it lacks any network-reaching capabilities. There are no instances of
curl,wget, or other exfiltration methods; all detected information remains within the agent's output for the user. - [PROMPT_INJECTION] (SAFE): The skill does not contain instructions that attempt to override the agent's core instructions, bypass safety filters, or extract system prompts. The 'Execution Flow' is a structured set of steps for a specific task.
- [INDIRECT_PROMPT_INJECTION] (LOW):
- Ingestion points: Reads contents of local files tracked by git.
- Boundary markers: None explicitly defined in the provided script logic, though it uses regex for specific pattern matching.
- Capability inventory: Limited to reading files and displaying matches; no file-write or network operations are present.
- Sanitization: The skill uses exclusion patterns (e.g., ignoring
node_modules, test files, and placeholders) which limits the processing of untrusted data.
Audit Metadata