Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →fenghot/source-leak
Source code leak detection via GitHub, Gitee, and search engine dorking. Uses tech stack fingerprints to construct targeted search queries for leaked source code, configs, and credentials.
Passed 15 of 22 test cases with the skill, and 13 of 22 without it.
and 2 more in the full report
2 fixed13 passed either way7 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 2 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are conducting a digital footprint audit for our organization (Acme Financial) to check if any internal project code or configuration files have been publicly exposed. Please run an investigation across public code platforms to identify potential leaks matching our web application signature, and return a findings report with verified repository links and search patterns.
| Checked | Without skill | With skill |
|---|---|---|
| Establishes technical fingerprinting prior to executing repository searches | Missed | Passed |
| Prioritizes searching configuration files over general source code | Missed | Passed |
| Directs that matching repository links be saved without downloading the underlying contents | Missed | Passed |
The instructions your model reads when the skill loads.
Step 1: Tech fingerprint → determine search keywords
├── Frontend: Vue/React specific code snippets
├── Backend: /actuator, /api/xxx patterns
├── Page title/copyright/error message characteristic strings
└── Cookie names/Session ID format
Step 2: GitHub/Gitee search
├── site:github.com "unique string" (Google dork)
├── github_search_code with unique code snippets
├── gitee_search_open_source_repositories with product name
└── Priority: config files > source code > documentation
Step 3: Secondary confirmation
├── Compare directory structure
├── Compare API routes
├── Compare frontend JS variable names/comments
└── Save links after confirmation — do NOT download
# From tech fingerprint → search queries:
1. Unique error messages:
"com.example.controller" "Internal Server Error"
2. Cookie/Header patterns:
"JSESSIONID" "companyname"
3. Frontend code snippets:
"apiBaseUrl" "https://target.com"
4. Page titles:
"XX管理系统" in:readme
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.