Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-exposed-secrets-files
Probe a target for accidentally-served secret-bearing files in the web root — `.git/`, `.env`, `.DS_Store`, backup files, database dumps, key files, CI configs, IDE configs.
Passed 17 of 20 test cases with the skill, and 10 of 20 without it.
and 5 more in the full report
8 fixed11 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 8 test cases the skill fixed. Same model, same prompt, with and without the skill.
Run the secret exposure check against https://prod-app.example.com where we are fully authorized, but suppress low and medium findings so we only see high and critical exposures.
| Checked | Without skill | With skill |
|---|---|---|
| Includes --min-severity high parameter in command | Missed | Passed |
The instructions your model reads when the skill loads.
The single highest-value pentest probe per HTTP request. A .git/config
disclosure leaks repo URL + credentials embedded in remote URLs. A .env
disclosure leaks every API key the app has. A backup.sql disclosure
leaks the entire database. These are not "weak crypto" findings that need
a chained exploit. They are direct, immediate compromise.
The probe set is the canonical 40+ paths web servers commonly expose by
accident: VCS directories (.git/, .svn/, .hg/), dotenv files,
OS metadata (.DS_Store), database dumps, archive files, IDE configs,
CI configs, and key files. Each is fingerprinted to distinguish a true
positive (server returns the file's expected content) from a 200 OK
that's actually the application's SPA index page catching the route.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
.git/HEAD reachable + valid content | CRITICAL | 200 + body matches ref: or 40-char SHA | NIST 800-53 SC-28 |
.git/config reachable + repo URL leaked | CRITICAL | 200 + body matches [remote | NIST 800-53 SC-28 |
.env reachable + dotenv format | CRITICAL | 200 + body matches KEY=VALUE lines | OWASP A05:2021 |
*.sql / *.dump / backup.* reachable | CRITICAL | 200 + body looks like SQL or binary dump | CWE-538 |
.aws/credentials reachable | CRITICAL | 200 + body matches [default]\naws_access_key_id | CWE-200 |
id_rsa / *.pem / *.key reachable | CRITICAL | 200 + body matches BEGIN PRIVATE KEY or BEGIN RSA | CWE-321 |
.svn/entries / .hg/store/ reachable | HIGH | 200 + body matches VCS format | NIST 800-53 SC-28 |
.DS_Store reachable | MEDIUM | 200 + binary blob with Bud1 magic | CWE-538 |
IDE configs (.idea/, .vscode/) reachable | LOW | 200 + JSON/XML | CWE-200 |
composer.json / package.json reachable on prod | LOW | 200 + valid JSON in non-API root | CWE-200 |
requests librarytest cases passed, vs 10 / 20 without
Published skills whose descriptions closely match this one, with their headline benchmark lift.
More skills from the same source and nearby in the registry, with their headline benchmark lift.