Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Add homepage URL
What This Skill Does
Wraps GitGuardian's ggshield CLI to scan repositories, files, staged changes, and Docker images for 500+ types of hardcoded secrets. It can install git pre-commit hooks to automatically block commits containing credentials before they reach version control.
ggshield combines entropy analysis, known-format pattern matching, and ML trained on real leaked credentials, catching secrets that simple regex scanners miss.
When to use it
- Scan a repo for leaked API keys before pushing to GitHub
- Audit an old project for credentials accidentally committed to history
- Block commits containing hardcoded secrets via pre-commit hooks
- Check a Docker image for secrets embedded in its layers
- Add automated secret detection to a CI/CD pipeline
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: scan my repo for secrets before I push
- 1Runs scan-repo on the target repository path
- 2ggshield scans all files and git history for secret patterns
- 3Identifies matches by file path and line number
- 4Returns a clean confirmation or a list of detected secrets with remediation advice
Found 2 secrets: AWS Access Key ID in config/prod.py:42, Slack API token in .env.backup:8. Rotate these credentials immediately and remove them from history.
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.