---
name: Secrets Scan
slug: secrets-scan
category: Quality
description: Secrets Scan runs TruffleHog through the mantis_trufflehog MCP server to find exposed credentials. Use it during secret audits and handle findings without ever revealing the raw secret.
github: "https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/secrets-scan"
language: Rust
stars: 490
forks: 73
install: "npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/secrets-scan ~/.claude/skills/secrets-scan"
installs_to: ~/.claude/skills/secrets-scan
source_path: .codex/skills/secrets-scan/SKILL.md
collection_size: 25
category_size: 1354
collection_url: "https://dirskills.com/collections/deonmenezes/mantishack"
added: 2026-08-26T05:13:19.979Z
last_synced: 2026-08-26T05:13:19.979Z
canonical_url: "https://dirskills.com/skills/secrets-scan"
---

# Secrets Scan

Secrets Scan runs TruffleHog through the mantis_trufflehog MCP server to find exposed credentials. Use it during secret audits and handle findings without ever revealing the raw secret.

**Install:**

```bash
npx degit https://github.com/deonmenezes/mantishack/tree/main/.codex/skills/secrets-scan ~/.claude/skills/secrets-scan
```

## README

Use `trufflehog_scan({ path, only_verified })` (mantis_trufflehog MCP server) for the **Detect** stage's secrets coverage.

- The server already redacts every secret value before it reaches you (`redacted_secret` is a masked preview, never the full value). Never try to reconstruct, print, or echo the full secret elsewhere -- e.g. don't re-read the source line containing it and paste it into a report just because the tool redacted its own output.
- `verified: true` means trufflehog live-checked the credential against its provider and it's currently active -- treat this as a near-`confirmed` finding with severity driven by what the credential can access. `verified: false` is a `candidate` (pattern-matched but not live-checked, could be a dead/rotated key or a false-positive-looking test fixture).
- Remediation for any verified secret is always: rotate/revoke the credential at the provider, then remove it from source (and consider it compromised in git history even after removal -- flag that separately, since simply deleting the line does not purge history).
- Set `only_verified: true` when you specifically want to cut noise from test fixtures and example keys; leave it off for full recall during an initial sweep.