---
name: "gitleaks-git-secret-scanner"
description: "Detect and prevent API keys, passwords, and tokens from being committed to Git."
metadata:
  author: "Gitleaks"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "scan git repository for secrets"
  - "run gitleaks pre-commit"
  - "detect leaked api keys git"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: false
  net_access: false
---

# Gitleaks High-Speed Pre-Commit Secret Scanner

Scans git commits, history, and files using Gitleaks: pattern regex rules, Shannon entropy analysis, custom .gitleaks.toml rules, and pre-commit hook integrations.

## When to Invoke
Invoke this skill whenever you need to:
- scan git repository for secrets
- run gitleaks pre-commit
- detect leaked api keys git

## Execution SOP & Rules
1. Run gitleaks detect --source . --verbose to audit current uncommitted files.
2. Run gitleaks git --verbose to scan historical commit logs and branches.
3. Define custom token patterns with entropy thresholds in .gitleaks.toml.
4. Revoke and rotate any token identified in git commit history immediately.

## Verification Checklist
- Run local linting, syntax validation, and type-checks before reporting completion.
- Ensure all created or modified files adhere to workspace boundaries and avoid uncommitted secrets.
- Verify tests or build commands exit cleanly with return code 0.