jd-opensource/joysafeter/pentest-secrets-exposure

Claude Code and agent skill by jd-opensource/joysafeter

Trust tier 3
  • community
Source check pending

Checking that the SKILL.md file is still in the repository.

Discover hardcoded credentials, leaked API keys, exposed configuration files, sensitive data in artifacts, and information disclosure via error handling.

Install

npx vskill@latest install jd-opensource/joysafeter/pentest-secrets-exposure

SKILL.md

Pentest Secrets Exposure

Purpose

Spans multiple unchecked WSTG categories — CONF-03/04 (sensitive files, backups), INFO-05 (info leakage), ERRH-01/02 (error handling, stack traces). Shannon's pre-recon focuses on architecture, not systematic secrets discovery.

Prerequisites

Authorization Requirements
  • Written authorization with source code access scope (if white-box)
  • Git repository access for history mining (if applicable)
  • Target URL list for exposed file probing
Environment Setup
  • TruffleHog for git history secret scanning
  • GitLeaks for pattern-based secret detection
  • Semgrep with secrets ruleset
  • nuclei with exposure templates

Core Workflow

  1. Source Code Secrets: Scan for hardcoded API keys, DB credentials, JWT signing keys, encryption keys using pattern + entropy detection.
  2. Git History Mining: Search all commits for secrets added then removed. Check force-pushed branches. Analyze .gitignore for sensitive patterns.
  3. Exposed Config Files: Probe for .env, .git/config, .DS_Store, wp-config.php, application.yml, docker-compose.yml with credentials (WSTG-CONF-03/04).
  4. Error Handling Disclosure: Trigger stack traces, debug pages, verbose errors revealing internal paths, DB schemas, framework versions (WSTG-ERRH-01/02).
  5. Backup & Unreferenced Files: .bak, .old, .swp, ~files, editor temp files, DB dumps, log files with sensitive data.
  6. Client-Side Bundle Analysis: Extract API keys from JS bundles, source maps exposing server code, hardcoded tokens in mobile packages.
  7. Secret Validation: Test each discovered credential for active access, document scope, assess blast radius.

WSTG Coverage

WSTG IDTest NameStatus
WSTG-CONF-03Test File Extensions Handling for Sensitive Info✅
WSTG-CONF-04Review Old Backup and Unreferenced Files✅
WSTG-INFO-05Review Webpage Content for Information Leakage✅
WSTG-ERRH-01Test Improper Error Handling✅
WSTG-ERRH-02Test Stack Traces✅

Tool Categories

CategoryToolsPurpose
Git ScanningTruffleHog, GitLeaksSecret detection in git history
Static AnalysisSemgrep (secrets rules), grep patternsSource code secret scanning
Web Probingnuclei (exposure templates), ffufExposed file/config discovery
JS AnalysisSecretFinder, LinkFinderClient-side bundle secret extraction
Validationcurl, custom scriptsCredential active-access testing

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors

Security

  • Security scanPassed, 100 of 100Pattern checks on the skill's files.
  • Model reviewPassed

See the full security report

Quality evaluation

  • Task evaluationNot runNo evaluation yet. Run one in Skill Studio.

See evaluation results

Source

Popularity

Repository stars
238
Repository forks
47
7-day trend score
27

Stars and forks are for the whole GitHub repository, not this skill alone. Refreshed 4 Apr 2026, 7 months ago.

Works with

Any agent vskill installs to: 56 targets in all. These 39 have a page on this site.

  • Claude Code
  • Cursor
  • GitHub Copilot
  • Windsurf
  • Codex
  • Gemini CLI
  • Cline
  • Amp
  • Roo Code
  • Goose
  • Continue
  • Kilo Code
  • Junie
  • Trae
  • OpenHands
  • Qwen Code
  • AI Agent
  • Tabnine Chat
  • Sourcegraph Cody
  • Amazon Q
  • Firebase Genkit
  • Sweep
  • Devin
  • Phind
  • Mentat
  • Claude Desktop
  • Aider
  • GPT Pilot
  • Plandex
  • bolt.new
  • v0
  • Replit Agent
  • Anse
  • TypingMind
  • BetterChatGPT
  • LibreChat
  • Warp AI
  • Pieces
  • Fig AI
Embed badge
vskill VERIFIED badge
[![vskill VERIFIED](https://verified-skill.com/api/v1/skills/jd-opensource/joysafeter/pentest-secrets-exposure/badge)](https://verified-skill.com/skills/jd-opensource/joysafeter/pentest-secrets-exposure)

Something wrong with this skill or its page? Tell us.