aeondave/trufflehog
offensive-tools/cloud/trufflehog/SKILL.md
Find leaked credentials and secrets in git repos, S3 buckets, filesystems, and CI systems using entropy analysis and 700+ detectors. Use when hunting for secrets in large codebases or cloud storage during recon.
$ install --global
skillsauthnpx skillsauth add aeondave/malskill trufflehogInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Mar 31, 2026, 9:04 PM58.4s1 file scanned
SKILL.md
- name:
- trufflehog
- description:
- Find leaked credentials and secrets in git repos, S3 buckets, filesystems, and CI systems using entropy analysis and 700+ detectors. Use when hunting for secrets in large codebases or cloud storage during recon.
- license:
- MIT
- compatibility:
- Go binary or Docker; Linux/macOS/Windows; github.com/trufflesecurity/trufflehog
- author:
- AeonDave
- version:
- 1.0
TruffleHog
Secret scanner with 700+ detectors — git history, S3, GCS, filesystem, and CI systems.
Quick Start
# Docker
docker run --rm trufflesecurity/trufflehog:latest git https://github.com/org/repo
# Binary
trufflehog git https://github.com/org/repo --only-verified
# Local repo
trufflehog git file:///path/to/repo --only-verified
# S3 bucket
trufflehog s3 --bucket=target-bucket
Core Flags
| Flag | Purpose |
|------|---------|
| git <url> | Scan git repo |
| s3 | Scan S3 bucket |
| filesystem | Scan local files |
| --only-verified | Show only verified secrets |
| --since-commit SHA | Scan from commit |
| --branch NAME | Scan specific branch |
| --json | JSON output |
| --concurrency N | Thread count |
| --include-detectors | Limit detector types |
Common Workflows
Verified secrets only (CI-safe):
trufflehog git https://github.com/org/repo --only-verified --json > secrets.json
Full history of internal monorepo:
trufflehog git file:///repos/monorepo --json --concurrency 8
S3 audit:
trufflehog s3 --bucket internal-assets --only-verified
Resources
| File | When to load |
|------|--------------|
| references/ | Detector list and custom detector config |
Related Skills
aeondave/unicorn
development
VerifiedTrustedCommunity
Auth/lab ref: Unicorn Engine CPU-only emulation for shellcode, decryptors, custom VM handlers, instruction tracing, memory hooks, and register-level experiments.
11SKILL.mdUpdated Jul 24, 2026
aeondave/renode
development
VerifiedTrustedCommunity
Auth/lab ref: Renode board and SoC simulation for MCU/RTOS firmware, UART/GPIO/peripheral modeling, GDB remote debugging, REPL platforms, and RESC scripts.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qiling
development
VerifiedTrustedCommunity
Auth/lab ref: Qiling OS-layer binary emulation for PE/ELF/Mach-O/UEFI/shellcode with rootfs, syscall/API hooks, filesystem mapping, and runtime patching.
11SKILL.mdUpdated Jul 24, 2026
aeondave/qemu
databases
VerifiedTrustedCommunity
Auth/lab ref: QEMU user-mode and full-system emulation for cross-arch binaries, firmware, kernels, disks, serial consoles, networking, and GDB stubs.
11SKILL.mdUpdated Jul 24, 2026