← All skills
private-secret-scanning
92 / 100 · Low risk
Fine to try. Some of what it can do is expected: a coding skill usually runs build and test commands.
By jamditis/claude-skills-journalism (GitHub) · coding · 452 stars · scanned at commit a6383bd
Local Gitleaks scans for staged changes, push ranges, and full history in private repos, with redacted reports. Use to block committed secrets without GitHub Secret Protection.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a coding skill.
Found in 26 places.
Show 17 more
- security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 313
expect 0 "clean repo passes history scan" bash -c "cd '$work/clean' && '$SCRIPT_PATH' history" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 318
expect 1 "staged leak fails" bash -c "cd '$work/staged' && '$SCRIPT_PATH' staged" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 322
bash -c "cd '$work/staged' && SECRET_SCAN_CONFIG='$work/staged/bad.toml' '$SCRIPT_PATH' staged" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 330
expect 1 "push-range leak fails" bash -c "cd '$work/push' && '$SCRIPT_PATH' push '$base..HEAD'" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 333
expect 1 "pre-push stdin with a leak fails" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 335
expect 1 "pre-push stdin for a new branch fails" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 338
expect 1 "pre-push new branch with a 64-zero id fails" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 340
expect 0 "pre-push deletion with a 64-zero id is skipped" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 350
expect 1 "new branch to a repointed remote still scans its history" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 354
expect 2 "pushing a tag that points at a blob is refused" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 356
expect 0 "push range before the leak passes" bash -c "cd '$work/push' && '$SCRIPT_PATH' push '$base~0..$base'" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 365
expect 1 "deleted leak fails history scan" bash -c "cd '$work/history' && '$SCRIPT_PATH' history --report '$work/report.json'" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 380
bash -c "cd '$work/history' && '$SCRIPT_PATH' history" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 383
bash -c "cd '$work/history/sub/dir' && '$SCRIPT_PATH' history" - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 386
expect 2 "an uncommitted .gitleaksignore cannot excuse a push" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 391
expect 0 "a committed .gitleaksignore applies to a push" bash -c \ - security-toolkit/skills/private-secret-scanning/scripts/secret-scan.sh, line 404
bash -c "cd '$work/clean' && GITLEAKS_BIN='$work/no-such-gitleaks' '$SCRIPT_PATH' staged"
and 6 more places
Connects to the internet
The author does not mention this.
Found in 1 place.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'private-secret-scanning' ] || [ -L ~/.agents/skills/'private-secret-scanning' ]; then echo 'A skill folder named private-secret-scanning already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/jamditis/claude-skills-journalism' "$d" && git -C "$d" checkout --quiet 'a6383bd0c4cb22cc04056875f4d50603489b003b' -- 'security-toolkit/skills/private-secret-scanning' && mkdir -p ~/.agents/skills && cp -R "$d"/'security-toolkit/skills/private-secret-scanning' ~/.agents/skills/'private-secret-scanning' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'private-secret-scanning' ~/.claude/skills/'private-secret-scanning' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for jamditis/claude-skills-journalism shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/jamditis/claude-skills-journalism/)
Score history
| Date | Version | Score |
|---|
| 2026-11-13 | a6383bd | 92 |
| 2026-11-07 | e1f38cb | 92 |