The Complete Production SOP: How to Deploy and Run TruffleHog Verified Git Secret & Key Detector in Autonomous AI Agents

---
name: "trufflehog-verified-credential-detector"
description: "Find leaked credentials in Git history and verify if they are active via live API checks."
metadata:
  author: "Truffle Security"
  version: "1.0.0"
  runtime_compatibility:
    - "codex"
    - "claude-code"
    - "cursor"
    - "windsurf"
triggers:
  - "scan repo with trufflehog"
  - "verify leaked credentials trufflehog"
  - "find active api keys git"
permissions:
  fs_read: true
  fs_write: "workspace"
  shell_exec: true
  net_access: true
---

# TruffleHog Verified Git Secret & Key Detector

Execute verification scans for active credentials across Git history and workspace files.

## Execution SOP & Rules
1. Run `trufflehog git file://. --results=verified --json` to filter out non-functional tokens.
2. Do NOT print the raw credential secrets into standard output logs.
3. Report only the secret detector type, commit hash, and file path.
4. Recommend immediate revocation and eradication using `git-filter-repo`.

#!/usr/bin/env bash
set -euo pipefail

if ! command -v trufflehog &> /dev/null; then
    echo "Error: trufflehog binary not found in PATH." >&2
    exit 1
fi

echo "TruffleHog version: $(trufflehog --version)"
echo "Tool verification passed."

#!/usr/bin/env bash
# Step 1: Revoke the key immediately at the provider dashboard/CLI
# Step 2: Purge file from history if accidentally tracked
TARGET_PATH="config/credentials.json"

if [ -f "$TARGET_PATH" ]; then
  git filter-repo --path "$TARGET_PATH" --invert-paths --force
  echo "Cleaned $TARGET_PATH from git history."
fi

# Step 3: Re-verify clean state
trufflehog git file://. --results=verified