secret-scan

# Vulnetix Secret Scan Skill ## Use when - Pre-commit: confirm no secrets in staged files (`--staged-only`). - Pre-push: scan diff vs `origin/HEAD` for high-confidence leaks. - Audit: full-repo scan for an exposed-secret incident. - Producing a rotation list — which provider keys need to be revoked NOW. - CI gate: block merge if any high-confidence secret detected. ## Don't use for - Vulnerability detection — use `/vulnetix:sast-scan` or `/vulnetix:sca-scan`. - Validating an already-fixed leak — use git filter-repo or BFG to remove from history. ## Conventions This skill follows [`_lib/contract.md`](../_lib/contract.md): the Vulnetix CLI is auto-installed by hooks, `.vulnetix/capabilities.yaml` is always present, every `vulnetix vdb` call is piped through a verified `jq` filter from [`_lib/jq/`](../_lib/jq/), independent calls run in parallel as concurrent Bash tool calls, and trailing follow-ups are limited to one line. See the contract for output style, memory write rules, and cooldowns. ## Step 1: Load capabilities Read `.vulnetix/capabilities.yaml`. Note `binaries.git` (required for `--staged-only`). ## Step 2: Decide scope - `--staged-only`: `git diff --cached --name-only` for the file list. - `--paths`: explicit list. - Default: changed files vs. main branch, fallback to whole repo. ## Step 3: Run scan ```bash vulnetix secrets --paths "$PATHS" -o json > .vulnetix/secrets.${TIMESTAMP}.json ``` Or via integrated scan: ```bash vulnetix scan --evaluate-secrets...