Gitleaks

Finds API keys, tokens and other secrets in a git history, a folder or piped input, locally and with no account.

Install

macOS
```
brew install gitleaks
```
Docker images and release binaries are listed in the README.
Scan a skill or folder
```
gitleaks dir -v path/to/skill
```
Scan a repo's full history
```
gitleaks git -v path/to/repo
```

A pattern-and-entropy secret scanner with a large built-in rule set. It covers what a skill-specific scanner can miss: a skill repo whose history once held a live key.

When to use it

Before listing or installing a skill: gitleaks git on its repo catches keys that were committed and later deleted.
As a pre-commit hook in your own skills repo, so a token never lands in git.
In CI, with --report-path and a baseline to track only new leaks.

Good to know

Use --redact when output goes to logs or a shared CI console. A clean result means no rule matched, not that no secret is there.

Publisher: Gitleaks
Source: github.com/gitleaks/gitleaks
Works with: Any agent
Categories: Security & trust
License: MIT
Cost: Free

Curated by Andrew Borden-Chisholm. Notes on building with these tools are on the blog.