[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AE9GJY0K1V3AM4AFGYDVXP":3,"skill-same:01M6AE9GJY0K1V3AM4AFGYDVXP":132},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":31,"publishedAt":50,"linkOnly":51,"markdownContent":52,"markdownBody":53,"frontMatter":54,"refName":91,"commitSha":92,"skillDirectory":93,"forksCount":94,"repositoryHtmlUrl":95,"repositoryHomepageUrl":96,"ownerHtmlUrl":97,"ownerBlogUrl":98,"ownerDescription":99,"updatedAt":100,"install":101,"resources":114},"01M6AE9GJY0K1V3AM4AFGYDVXP","detecting-aws-credential-exposure-with-trufflehog",null,"Scan source code repositories, CI\u002FCD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI\u002FCD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.","mukul975\u002FAnthropic-Cybersecurity-Skills","mukul975","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42860185?v=4","01M6ADEQR8T5M4EEG6C67BQCWF","Mahipal","01M6ADJPMYWG1E5GM1FWBE3128",36078,"Apache-2.0","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-credential-exposure-with-trufflehog\u002FSKILL.md",[18,23,26],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",{"categoryNo":27,"categoryName":28,"taxonomyType":29,"taxonomyTypeDesc":30},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49],"detecting aws credential exposure with trufflehog","aws","ci","secrets-detection","trufflehog","credential-exposure","detection","reconnaissance","cloud-security","devsecops","cloud","search","git","authentication","code","pr","cybersecurity","security","2026-11-10 10:12:30",false,"---\nname: detecting-aws-credential-exposure-with-trufflehog\ndescription: 'Scan source code repositories, CI\u002FCD pipelines, and configuration files\n  for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection.\n  Use when integrating secrets scanning into CI\u002FCD, auditing repositories (including\n  git history) for historically committed AWS keys, responding to a GuardDuty alert\n  about credential use from an unexpected location, or verifying credential rotation\n  removed all exposed keys.\n\n  '\ndomain: cybersecurity\nsubdomain: cloud-security\ntags:\n- cloud-security\n- aws\n- credential-exposure\n- trufflehog\n- secrets-detection\n- devsecops\nversion: '1.0'\nauthor: mahipal\nlicense: Apache-2.0\nnist_csf:\n- PR.IR-01\n- ID.AM-08\n- GV.SC-06\n- DE.CM-01\nmitre_attack:\n- T1552.001\n- T1552\n- T1078.004\n- T1589.001\nmitre_f3:\n  version: '1.1'\n  tactics:\n  - reconnaissance\n  - initial-access\n  techniques:\n  - id: T1593\n    name: Search Open Websites\u002FDomains\n    tactic: reconnaissance\n    source: attack\n  - id: F1006\n    name: Account Takeover\n    tactic: initial-access\n    source: f3\n  - id: F1006.001\n    name: 'Account Takeover: Exposed API Key'\n    tactic: initial-access\n    source: f3\n  - id: F1006.002\n    name: 'Account Takeover: Exposed Login Credential'\n    tactic: initial-access\n    source: f3\n  - id: T1550.001\n    name: 'Use Alternate Authentication Material: Application Access Token'\n    tactic: initial-access\n    source: attack\n---\n\n# Detecting AWS Credential Exposure with TruffleHog\n\n## When to Use\n\n- When integrating secrets detection into CI\u002FCD pipelines to prevent credential commits reaching production\n- When performing a security audit of existing repositories for historically committed AWS credentials\n- When responding to an AWS GuardDuty alert about credential usage from an unexpected IP or region\n- When onboarding repositories from acquired companies or third-party vendors\n- When validating that credential rotation processes have removed all references to old access keys\n\n**Do not use** for real-time credential monitoring (use AWS GuardDuty or Amazon Macie), for managing secrets (use AWS Secrets Manager or HashiCorp Vault), or for detecting non-credential sensitive data like PII (use Amazon Macie or DLP tools).\n\n## Prerequisites\n\n- TruffleHog v3 installed (`brew install trufflehog` or `pip install trufflehog`)\n- git-secrets installed for pre-commit hook integration (`brew install git-secrets`)\n- Access to source code repositories (GitHub, GitLab, Bitbucket, or local git repos)\n- AWS CLI configured with permissions to check key status (`iam:ListAccessKeys`, `iam:GetAccessKeyLastUsed`)\n- GitHub or GitLab API token for scanning organization-wide repositories\n\n## Workflow\n\n### Step 1: Install and Configure TruffleHog\n\nInstall TruffleHog v3 and verify it can detect the AWS credential patterns.\n\n```bash\n# Install TruffleHog v3\npip install trufflehog\n\n# Or install from binary release\ncurl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Ftrufflesecurity\u002Ftrufflehog\u002Fmain\u002Fscripts\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n# Verify installation\ntrufflehog --version\n\n# Test with a known test repository\ntrufflehog git https:\u002F\u002Fgithub.com\u002Ftrufflesecurity\u002Ftest_keys --only-verified\n```\n\n### Step 2: Scan Git Repositories for Exposed Credentials\n\nScan entire git history including all branches and commits for AWS access keys, secret keys, and session tokens.\n\n```bash\n# Scan a local git repository (full history)\ntrufflehog git file:\u002F\u002F\u002Fpath\u002Fto\u002Frepo --only-verified --json > trufflehog-results.json\n\n# Scan a GitHub organization's repositories\ntrufflehog github --org=your-organization --token=$GITHUB_TOKEN --only-verified\n\n# Scan a specific GitHub repository with all branches\ntrufflehog git https:\u002F\u002Fgithub.com\u002Forg\u002Frepo.git --only-verified --branch=main\n\n# Scan a GitLab group\ntrufflehog gitlab --group=your-group --token=$GITLAB_TOKEN --only-verified\n\n# Scan filesystem paths for credentials in config files\ntrufflehog filesystem \u002Fpath\u002Fto\u002Fproject --only-verified\n```\n\n### Step 3: Analyze and Validate Detected Credentials\n\nParse TruffleHog results to identify verified (still-active) credentials versus rotated or test keys.\n\n```bash\n# Parse TruffleHog JSON output for AWS findings\ncat trufflehog-results.json | python3 -c \"\nimport json, sys\nfor line in sys.stdin:\n    finding = json.loads(line)\n    if 'AWS' in finding.get('DetectorName', ''):\n        print(f\\\"Detector: {finding['DetectorName']}\\\")\n        print(f\\\"Verified: {finding.get('Verified', False)}\\\")\n        print(f\\\"Source: {finding.get('SourceMetadata', {})}\\\")\n        print(f\\\"Commit: {finding.get('SourceMetadata', {}).get('Data', {}).get('Git', {}).get('commit', 'N\u002FA')}\\\")\n        print(f\\\"File: {finding.get('SourceMetadata', {}).get('Data', {}).get('Git', {}).get('file', 'N\u002FA')}\\\")\n        print('---')\n\"\n\n# Check if a detected access key is still active\naws iam get-access-key-last-used --access-key-id AKIAIOSFODNN7EXAMPLE\n\n# List all access keys for a user to find active keys\naws iam list-access-keys --user-name target-user \\\n  --query 'AccessKeyMetadata[*].[AccessKeyId,Status,CreateDate]' --output table\n```\n\n### Step 4: Set Up Pre-Commit Hooks with git-secrets\n\nPrevent credentials from being committed in the first place using git-secrets as a pre-commit hook.\n\n```bash\n# Install git-secrets\ngit secrets --install  # In each repository\n\n# Register AWS credential patterns\ngit secrets --register-aws\n\n# Add custom patterns for internal credential formats\ngit secrets --add 'AKIA[0-9A-Z]{16}'\ngit secrets --add 'aws_secret_access_key\\s*=\\s*.{40}'\ngit secrets --add 'aws_session_token\\s*=\\s*.+'\n\n# Scan entire repository history\ngit secrets --scan-history\n\n# Add to global git template for all new repos\ngit secrets --install ~\u002F.git-templates\u002Fgit-secrets\ngit config --global init.templateDir ~\u002F.git-templates\u002Fgit-secrets\n```\n\n### Step 5: Integrate TruffleHog into CI\u002FCD Pipeline\n\nAdd TruffleHog scanning as a CI\u002FCD gate to block deployments containing exposed credentials.\n\n```yaml\n# GitHub Actions workflow (.github\u002Fworkflows\u002Fsecrets-scan.yml)\nname: Secrets Scan\non: [push, pull_request]\n\njobs:\n  trufflehog:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0\n      - name: TruffleHog Scan\n        uses: trufflesecurity\u002Ftrufflehog@main\n        with:\n          extra_args: --only-verified --results=verified\n```\n\n```yaml\n# GitLab CI (.gitlab-ci.yml)\nsecrets_scan:\n  stage: test\n  image: trufflesecurity\u002Ftrufflehog:latest\n  script:\n    - trufflehog git file:\u002F\u002F$CI_PROJECT_DIR --since-commit $CI_COMMIT_BEFORE_SHA --only-verified --fail\n  allow_failure: false\n```\n\n### Step 6: Respond to Detected Credential Exposure\n\nExecute incident response procedures when verified credentials are found exposed.\n\n```bash\n# IMMEDIATE: Deactivate the exposed access key\naws iam update-access-key \\\n  --user-name compromised-user \\\n  --access-key-id AKIAEXPOSEDKEY123456 \\\n  --status Inactive\n\n# Generate new credentials\naws iam create-access-key --user-name compromised-user\n\n# Review CloudTrail for unauthorized usage of the exposed key\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAEXPOSEDKEY123456 \\\n  --start-time 2026-01-01T00:00:00Z \\\n  --query 'Events[*].[EventTime,EventName,EventSource,SourceIPAddress]' \\\n  --output table\n\n# Delete the exposed key after rotation is confirmed\naws iam delete-access-key \\\n  --user-name compromised-user \\\n  --access-key-id AKIAEXPOSEDKEY123456\n\n# Remove the credential from git history using BFG Repo Cleaner\njava -jar bfg.jar --replace-text credentials.txt repo.git\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| TruffleHog | Open-source secrets detection tool that scans git history, filesystems, and cloud services for exposed credentials using regex patterns and verification APIs |\n| Verified Secret | A credential that TruffleHog has confirmed is still active by making an API call to the target service (e.g., AWS STS GetCallerIdentity) |\n| git-secrets | AWS Labs pre-commit hook tool that prevents committing strings matching AWS credential patterns to git repositories |\n| Access Key Rotation | The practice of regularly replacing AWS access key pairs to limit the window of exposure if a key is compromised |\n| BFG Repo Cleaner | Tool for removing sensitive data from git history without rewriting the entire repository, faster than git filter-branch |\n| GitHub Secret Scanning | GitHub-native feature that scans public repositories for known credential patterns and notifies the credential provider |\n\n## Tools & Systems\n\n- **TruffleHog v3**: Primary scanning engine supporting git, filesystem, S3, and CI\u002FCD integration with verified credential detection\n- **git-secrets**: AWS Labs pre-commit hook for preventing credential commits at the developer workstation level\n- **BFG Repo Cleaner**: Fast tool for removing credentials from git history after exposure is detected\n- **AWS GuardDuty**: Threat detection service that alerts on anomalous usage of AWS credentials from unexpected locations\n- **GitHub Advanced Security**: Platform-native secret scanning for GitHub repositories with push protection\n\n## Common Scenarios\n\n### Scenario: Developer Commits AWS Credentials to a Public GitHub Repository\n\n**Context**: GitHub secret scanning notifies that an AWS access key was pushed to a public repository. The key belongs to a developer with production S3 and DynamoDB access.\n\n**Approach**:\n1. Immediately deactivate the access key using `aws iam update-access-key --status Inactive`\n2. Run `aws cloudtrail lookup-events` filtering by the exposed AccessKeyId to check for unauthorized usage\n3. Scan the full repository history with `trufflehog git` to find any other exposed credentials\n4. Generate a new access key for the developer and deliver it through Secrets Manager\n5. Remove the credential from git history using BFG Repo Cleaner\n6. Install git-secrets pre-commit hook on the developer's workstation\n7. Add TruffleHog to the repository's CI\u002FCD pipeline to prevent recurrence\n\n**Pitfalls**: Simply deleting the commit or force-pushing does not remove credentials from GitHub's cache or forks. The key must be deactivated at the AWS level immediately. GitHub secret scanning may have already notified AWS, triggering automated key deactivation.\n\n## Output Format\n\n```\nAWS Credential Exposure Scan Report\n======================================\nScan Target: github.com\u002Facme-corp (42 repositories)\nScan Date: 2026-02-23\nTool: TruffleHog v3.63.0\nMode: Full git history scan with verification\n\nVERIFIED FINDINGS (Active Credentials):\n[CRED-001] AWS Access Key - VERIFIED ACTIVE\n  Key ID: AKIA...WXYZ\n  Repository: acme-corp\u002Fbackend-api\n  File: deploy\u002Fconfig.env\n  Commit: a1b2c3d (2025-08-15)\n  Author: developer@acme.com\n  IAM User: svc-backend-deploy\n  Permissions: S3, DynamoDB, SQS (production)\n  Status: CRITICAL - Key active and used from 3 IP addresses\n  Action Required: Immediate deactivation and rotation\n\n[CRED-002] AWS Secret Key - VERIFIED ACTIVE\n  Repository: acme-corp\u002Fdata-pipeline\n  File: scripts\u002Fetl_config.py\n  Commit: d4e5f6g (2025-11-22)\n  Author: data-engineer@acme.com\n  Status: HIGH - Key active, last used 2 days ago\n\nUNVERIFIED FINDINGS (Potential Credentials):\n  Total pattern matches: 15\n  Likely test\u002Fexample keys: 12\n  Requires manual review: 3\n\nSUMMARY:\n  Repositories scanned: 42\n  Commits analyzed: 125,847\n  Verified active credentials: 2\n  Unverified credential patterns: 15\n  Repositories with pre-commit hooks: 8 \u002F 42\n```\n","# Detecting AWS Credential Exposure with TruffleHog\n\n## When to Use\n\n- When integrating secrets detection into CI\u002FCD pipelines to prevent credential commits reaching production\n- When performing a security audit of existing repositories for historically committed AWS credentials\n- When responding to an AWS GuardDuty alert about credential usage from an unexpected IP or region\n- When onboarding repositories from acquired companies or third-party vendors\n- When validating that credential rotation processes have removed all references to old access keys\n\n**Do not use** for real-time credential monitoring (use AWS GuardDuty or Amazon Macie), for managing secrets (use AWS Secrets Manager or HashiCorp Vault), or for detecting non-credential sensitive data like PII (use Amazon Macie or DLP tools).\n\n## Prerequisites\n\n- TruffleHog v3 installed (`brew install trufflehog` or `pip install trufflehog`)\n- git-secrets installed for pre-commit hook integration (`brew install git-secrets`)\n- Access to source code repositories (GitHub, GitLab, Bitbucket, or local git repos)\n- AWS CLI configured with permissions to check key status (`iam:ListAccessKeys`, `iam:GetAccessKeyLastUsed`)\n- GitHub or GitLab API token for scanning organization-wide repositories\n\n## Workflow\n\n### Step 1: Install and Configure TruffleHog\n\nInstall TruffleHog v3 and verify it can detect the AWS credential patterns.\n\n```bash\n# Install TruffleHog v3\npip install trufflehog\n\n# Or install from binary release\ncurl -sSfL https:\u002F\u002Fraw.githubusercontent.com\u002Ftrufflesecurity\u002Ftrufflehog\u002Fmain\u002Fscripts\u002Finstall.sh | sh -s -- -b \u002Fusr\u002Flocal\u002Fbin\n\n# Verify installation\ntrufflehog --version\n\n# Test with a known test repository\ntrufflehog git https:\u002F\u002Fgithub.com\u002Ftrufflesecurity\u002Ftest_keys --only-verified\n```\n\n### Step 2: Scan Git Repositories for Exposed Credentials\n\nScan entire git history including all branches and commits for AWS access keys, secret keys, and session tokens.\n\n```bash\n# Scan a local git repository (full history)\ntrufflehog git file:\u002F\u002F\u002Fpath\u002Fto\u002Frepo --only-verified --json > trufflehog-results.json\n\n# Scan a GitHub organization's repositories\ntrufflehog github --org=your-organization --token=$GITHUB_TOKEN --only-verified\n\n# Scan a specific GitHub repository with all branches\ntrufflehog git https:\u002F\u002Fgithub.com\u002Forg\u002Frepo.git --only-verified --branch=main\n\n# Scan a GitLab group\ntrufflehog gitlab --group=your-group --token=$GITLAB_TOKEN --only-verified\n\n# Scan filesystem paths for credentials in config files\ntrufflehog filesystem \u002Fpath\u002Fto\u002Fproject --only-verified\n```\n\n### Step 3: Analyze and Validate Detected Credentials\n\nParse TruffleHog results to identify verified (still-active) credentials versus rotated or test keys.\n\n```bash\n# Parse TruffleHog JSON output for AWS findings\ncat trufflehog-results.json | python3 -c \"\nimport json, sys\nfor line in sys.stdin:\n    finding = json.loads(line)\n    if 'AWS' in finding.get('DetectorName', ''):\n        print(f\\\"Detector: {finding['DetectorName']}\\\")\n        print(f\\\"Verified: {finding.get('Verified', False)}\\\")\n        print(f\\\"Source: {finding.get('SourceMetadata', {})}\\\")\n        print(f\\\"Commit: {finding.get('SourceMetadata', {}).get('Data', {}).get('Git', {}).get('commit', 'N\u002FA')}\\\")\n        print(f\\\"File: {finding.get('SourceMetadata', {}).get('Data', {}).get('Git', {}).get('file', 'N\u002FA')}\\\")\n        print('---')\n\"\n\n# Check if a detected access key is still active\naws iam get-access-key-last-used --access-key-id AKIAIOSFODNN7EXAMPLE\n\n# List all access keys for a user to find active keys\naws iam list-access-keys --user-name target-user \\\n  --query 'AccessKeyMetadata[*].[AccessKeyId,Status,CreateDate]' --output table\n```\n\n### Step 4: Set Up Pre-Commit Hooks with git-secrets\n\nPrevent credentials from being committed in the first place using git-secrets as a pre-commit hook.\n\n```bash\n# Install git-secrets\ngit secrets --install  # In each repository\n\n# Register AWS credential patterns\ngit secrets --register-aws\n\n# Add custom patterns for internal credential formats\ngit secrets --add 'AKIA[0-9A-Z]{16}'\ngit secrets --add 'aws_secret_access_key\\s*=\\s*.{40}'\ngit secrets --add 'aws_session_token\\s*=\\s*.+'\n\n# Scan entire repository history\ngit secrets --scan-history\n\n# Add to global git template for all new repos\ngit secrets --install ~\u002F.git-templates\u002Fgit-secrets\ngit config --global init.templateDir ~\u002F.git-templates\u002Fgit-secrets\n```\n\n### Step 5: Integrate TruffleHog into CI\u002FCD Pipeline\n\nAdd TruffleHog scanning as a CI\u002FCD gate to block deployments containing exposed credentials.\n\n```yaml\n# GitHub Actions workflow (.github\u002Fworkflows\u002Fsecrets-scan.yml)\nname: Secrets Scan\non: [push, pull_request]\n\njobs:\n  trufflehog:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions\u002Fcheckout@v4\n        with:\n          fetch-depth: 0\n      - name: TruffleHog Scan\n        uses: trufflesecurity\u002Ftrufflehog@main\n        with:\n          extra_args: --only-verified --results=verified\n```\n\n```yaml\n# GitLab CI (.gitlab-ci.yml)\nsecrets_scan:\n  stage: test\n  image: trufflesecurity\u002Ftrufflehog:latest\n  script:\n    - trufflehog git file:\u002F\u002F$CI_PROJECT_DIR --since-commit $CI_COMMIT_BEFORE_SHA --only-verified --fail\n  allow_failure: false\n```\n\n### Step 6: Respond to Detected Credential Exposure\n\nExecute incident response procedures when verified credentials are found exposed.\n\n```bash\n# IMMEDIATE: Deactivate the exposed access key\naws iam update-access-key \\\n  --user-name compromised-user \\\n  --access-key-id AKIAEXPOSEDKEY123456 \\\n  --status Inactive\n\n# Generate new credentials\naws iam create-access-key --user-name compromised-user\n\n# Review CloudTrail for unauthorized usage of the exposed key\naws cloudtrail lookup-events \\\n  --lookup-attributes AttributeKey=AccessKeyId,AttributeValue=AKIAEXPOSEDKEY123456 \\\n  --start-time 2026-01-01T00:00:00Z \\\n  --query 'Events[*].[EventTime,EventName,EventSource,SourceIPAddress]' \\\n  --output table\n\n# Delete the exposed key after rotation is confirmed\naws iam delete-access-key \\\n  --user-name compromised-user \\\n  --access-key-id AKIAEXPOSEDKEY123456\n\n# Remove the credential from git history using BFG Repo Cleaner\njava -jar bfg.jar --replace-text credentials.txt repo.git\n```\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| TruffleHog | Open-source secrets detection tool that scans git history, filesystems, and cloud services for exposed credentials using regex patterns and verification APIs |\n| Verified Secret | A credential that TruffleHog has confirmed is still active by making an API call to the target service (e.g., AWS STS GetCallerIdentity) |\n| git-secrets | AWS Labs pre-commit hook tool that prevents committing strings matching AWS credential patterns to git repositories |\n| Access Key Rotation | The practice of regularly replacing AWS access key pairs to limit the window of exposure if a key is compromised |\n| BFG Repo Cleaner | Tool for removing sensitive data from git history without rewriting the entire repository, faster than git filter-branch |\n| GitHub Secret Scanning | GitHub-native feature that scans public repositories for known credential patterns and notifies the credential provider |\n\n## Tools & Systems\n\n- **TruffleHog v3**: Primary scanning engine supporting git, filesystem, S3, and CI\u002FCD integration with verified credential detection\n- **git-secrets**: AWS Labs pre-commit hook for preventing credential commits at the developer workstation level\n- **BFG Repo Cleaner**: Fast tool for removing credentials from git history after exposure is detected\n- **AWS GuardDuty**: Threat detection service that alerts on anomalous usage of AWS credentials from unexpected locations\n- **GitHub Advanced Security**: Platform-native secret scanning for GitHub repositories with push protection\n\n## Common Scenarios\n\n### Scenario: Developer Commits AWS Credentials to a Public GitHub Repository\n\n**Context**: GitHub secret scanning notifies that an AWS access key was pushed to a public repository. The key belongs to a developer with production S3 and DynamoDB access.\n\n**Approach**:\n1. Immediately deactivate the access key using `aws iam update-access-key --status Inactive`\n2. Run `aws cloudtrail lookup-events` filtering by the exposed AccessKeyId to check for unauthorized usage\n3. Scan the full repository history with `trufflehog git` to find any other exposed credentials\n4. Generate a new access key for the developer and deliver it through Secrets Manager\n5. Remove the credential from git history using BFG Repo Cleaner\n6. Install git-secrets pre-commit hook on the developer's workstation\n7. Add TruffleHog to the repository's CI\u002FCD pipeline to prevent recurrence\n\n**Pitfalls**: Simply deleting the commit or force-pushing does not remove credentials from GitHub's cache or forks. The key must be deactivated at the AWS level immediately. GitHub secret scanning may have already notified AWS, triggering automated key deactivation.\n\n## Output Format\n\n```\nAWS Credential Exposure Scan Report\n======================================\nScan Target: github.com\u002Facme-corp (42 repositories)\nScan Date: 2026-02-23\nTool: TruffleHog v3.63.0\nMode: Full git history scan with verification\n\nVERIFIED FINDINGS (Active Credentials):\n[CRED-001] AWS Access Key - VERIFIED ACTIVE\n  Key ID: AKIA...WXYZ\n  Repository: acme-corp\u002Fbackend-api\n  File: deploy\u002Fconfig.env\n  Commit: a1b2c3d (2025-08-15)\n  Author: developer@acme.com\n  IAM User: svc-backend-deploy\n  Permissions: S3, DynamoDB, SQS (production)\n  Status: CRITICAL - Key active and used from 3 IP addresses\n  Action Required: Immediate deactivation and rotation\n\n[CRED-002] AWS Secret Key - VERIFIED ACTIVE\n  Repository: acme-corp\u002Fdata-pipeline\n  File: scripts\u002Fetl_config.py\n  Commit: d4e5f6g (2025-11-22)\n  Author: data-engineer@acme.com\n  Status: HIGH - Key active, last used 2 days ago\n\nUNVERIFIED FINDINGS (Potential Credentials):\n  Total pattern matches: 15\n  Likely test\u002Fexample keys: 12\n  Requires manual review: 3\n\nSUMMARY:\n  Repositories scanned: 42\n  Commits analyzed: 125,847\n  Verified active credentials: 2\n  Unverified credential patterns: 15\n  Repositories with pre-commit hooks: 8 \u002F 42\n```\n",{"name":5,"tags":55,"author":56,"domain":48,"license":15,"version":57,"mitre_f3":58,"nist_csf":80,"subdomain":40,"description":85,"mitre_attack":86},[40,33,37,36,35,41],"mahipal","1.0",{"tactics":59,"version":61,"techniques":62},[39,60],"initial-access","1.1",[63,67,71,74,77],{"id":64,"name":65,"source":66,"tactic":39},"T1593","Search Open Websites\u002FDomains","attack",{"id":68,"name":69,"source":70,"tactic":60},"F1006","Account Takeover","f3",{"id":72,"name":73,"source":70,"tactic":60},"F1006.001","Account Takeover: Exposed API Key",{"id":75,"name":76,"source":70,"tactic":60},"F1006.002","Account Takeover: Exposed Login Credential",{"id":78,"name":79,"source":66,"tactic":60},"T1550.001","Use Alternate Authentication Material: Application Access Token",[81,82,83,84],"PR.IR-01","ID.AM-08","GV.SC-06","DE.CM-01","Scan source code repositories, CI\u002FCD pipelines, and configuration files for exposed AWS credentials using TruffleHog, git-secrets, and AWS-native detection. Use when integrating secrets scanning into CI\u002FCD, auditing repositories (including git history) for historically committed AWS keys, responding to a GuardDuty alert about credential use from an unexpected location, or verifying credential rotation removed all exposed keys.\n",[87,88,89,90],"T1552.001","T1552","T1078.004","T1589.001","main","54a798831d2266a3ca61ce68a7acb80b81160d57","skills\u002Fdetecting-aws-credential-exposure-with-trufflehog",4414,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills","https:\u002F\u002Fmahipal.engineer\u002FAnthropic-Cybersecurity-Skills\u002F","https:\u002F\u002Fgithub.com\u002Fmukul975","Mahipal.engineer","🔐 Cybersecurity | 💻 Dev | 📷 Street Photographer\r\n🎓 MSc | 📚 Research & AI Security","2026-08-31 12:32:44",{"source":8,"skillName":5,"commands":102,"prompt":112,"zipAvailable":113},[103,106,109],{"tool":104,"command":105},"npx","npx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-aws-credential-exposure-with-trufflehog",{"tool":107,"command":108},"bunx","bunx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-aws-credential-exposure-with-trufflehog",{"tool":110,"command":111},"pnpm","pnpm dlx skills add mukul975\u002FAnthropic-Cybersecurity-Skills --skill detecting-aws-credential-exposure-with-trufflehog","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-credential-exposure-with-trufflehog\u002FSKILL.md",true,[115,120,126],{"path":116,"resourceType":116,"resourceTypeDesc":117,"sizeBytes":118,"sourceHtmlUrl":119},"LICENSE","许可证",11255,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-credential-exposure-with-trufflehog\u002FLICENSE",{"path":121,"resourceType":122,"resourceTypeDesc":123,"sizeBytes":124,"sourceHtmlUrl":125},"references\u002Fapi-reference.md","REFERENCE","参考文档",2128,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-credential-exposure-with-trufflehog\u002Freferences\u002Fapi-reference.md",{"path":127,"resourceType":128,"resourceTypeDesc":129,"sizeBytes":130,"sourceHtmlUrl":131},"scripts\u002Fagent.py","SCRIPT","脚本",7790,"https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fdetecting-aws-credential-exposure-with-trufflehog\u002Fscripts\u002Fagent.py",[133,156,180,207,233,260],{"skillNo":134,"name":135,"nameZh":6,"description":136,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":137,"categories":138,"keywords":140,"publishedAt":50},"01M6AGDM3HJXTKXX15ZZ0ZVCJ3","verifying-build-provenance-with-slsa-sigstore","Verifies artifact signatures and SLSA provenance using Sigstore's cosign (verify, verify-attestation, verify-blob-attestation) and slsa-verifier (verify-artifact), enforcing keyless OIDC builder identity and source repo against SLSA Build levels. Use in CI\u002FCD before deploying artifacts, when consuming third-party attestations, establishing a SLSA Build L3 pipeline, or confirming provenance during incident response or admission control.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fverifying-build-provenance-with-slsa-sigstore\u002FSKILL.md",[139],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[141,142,143,144,49,48,145,146,47,46,147,34,148,149,150,151,152,153,154,155],"sigstore","provenance","slsa","verifying build provenance with slsa sigstore","incident response","identity","artifacts","supply-chain","pipeline","supply-chain-security","t1195","attestation","code-signing","cosign","keyless",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":163,"publishedAt":50},"01M6AGDGBPWYVZ2F11GFKJ4HZ9","validating-tpm-measured-boot-attestation","Verifies TPM 2.0 measured-boot integrity and remote attestation with tpm2-tools -- reading PCRs (tpm2_pcrread), replaying the boot event log, generating and checking signed quotes (tpm2_quote\u002Ftpm2_checkquote), and sealing secrets to a PCR policy. Use to confirm a system booted trusted firmware\u002Fkernel for Zero Trust device posture, detect boot-chain tampering via PCR drift, or build a golden-value baseline for fleet attestation.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-tpm-measured-boot-attestation\u002FSKILL.md",[162],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[164,152,165,166,49,167,48,47,168,169,170,171,172,173,174,175,176,177,178,179],"boot","TPM","validating tpm measured boot attestation","policy","verification","ZeRO","firmware","Tools","measured-boot","PCR","integrity","secrets","remote-attestation","tpm2-tools","integrity-verification","trusted-computing",{"skillNo":181,"name":182,"nameZh":6,"description":183,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":184,"categories":185,"keywords":190,"publishedAt":50},"01M6AGDCW0Y4FXZ3362GT1941M","validating-backup-integrity-for-recovery","Validates backup integrity through cryptographic hash verification, automated restore testing, corruption detection, and recoverability checks to confirm backups are reliable for disaster recovery and ransomware response. Use before relying on backups for recovery, when building post-backup validation pipelines, auditing backup infrastructure for compliance, or checking immutable\u002Fair-gapped backups for silent corruption or tampering.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Fvalidating-backup-integrity-for-recovery\u002FSKILL.md",[186,189],{"categoryNo":187,"categoryName":188,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[174,191,192,193,194,48,195,196,168,197,198,199,200,201,38,202,203,204,205,206],"backup","recovery","validating backup integrity for recovery","testing","infrastructure","validation","compliance","hash-verification","incident-response","ransomware","cryptocurrency","t1078","t1490","immutable","disaster-recovery","restore-testing",{"skillNo":208,"name":209,"nameZh":6,"description":210,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":211,"categories":212,"keywords":214,"publishedAt":50},"01M6AGD9GBG2KZ336AE763J3WH","triaging-windows-with-kape","Runs KAPE (Kroll Artifact Parser and Extractor) to collect targeted forensic artifacts (registry hives, $MFT, event logs, prefetch, browser data) via Targets and parse them with Modules wrapping Eric Zimmerman's EZ Tools (PECmd, MFTECmd, RECmd). Use during early incident containment\u002Ftriage when full disk imaging is impractical but a defensible, parseable Windows artifact set is needed quickly, including at-scale remote collection.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-windows-with-kape\u002FSKILL.md",[213],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[215,216,217,48,218,219,220,221,222,223,224,225,226,227,228,229,171,230,231,232],"windows","kape","triaging windows with kape","registry","browser","logs","windows-forensics","dfir","mft","mftecmd","data","prefetch","eric-zimmerman","digital-forensics","SET","collection","pecmd","artifact-collection",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":240,"publishedAt":50},"01M6AGD5PW5J4EVZM958WD74ZQ","triaging-vulnerabilities-with-ssvc-framework","Triages and prioritizes vulnerabilities with CISA's Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree, weighing exploitation status (via the CISA KEV catalog and FIRST EPSS API), technical impact, automatability, and mission prevalence to output Track\u002FTrack*\u002FAttend\u002FAct decisions. Use when prioritizing vulnerability scan results (OpenVAS, Nessus, Qualys) for remediation planning beyond raw CVSS scores.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-vulnerabilities-with-ssvc-framework\u002FSKILL.md",[239],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[241,242,243,48,244,245,246,247,248,249,250,251,252,253,254,255,256,257,258,259],"vulnerabilities","framework","triaging vulnerabilities with ssvc framework","status","planning","CISA","vulnerability-management","risk-management","nessus","qualys","openvas","cvss","remediation","risk","vulnerability","api","prioritization","ssvc","decision-tree",{"skillNo":261,"name":262,"nameZh":6,"description":263,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":264,"categories":265,"keywords":267,"publishedAt":50},"01M6AGD24TTQQM4CXG69E3B9TJ","triaging-security-incident","Performs initial triage of security incidents using the NIST SP 800-61r3 and SANS PICERL frameworks, classifying incident type, assigning priority by business impact, and routing to the appropriate response team. Use when a SIEM\u002FEDR alert needs human classification, concurrent alerts must be prioritized, or a user report or threat-intel IOC match requires initial incident categorization.","https:\u002F\u002Fgithub.com\u002Fmukul975\u002FAnthropic-Cybersecurity-Skills\u002Fblob\u002Fmain\u002Fskills\u002Ftriaging-security-incident\u002FSKILL.md",[266],{"categoryNo":24,"categoryName":25,"taxonomyType":21,"taxonomyTypeDesc":22},[49,268,48,269,270,271,272,273,274,275,276,202,277,203,278,279,280,281,282,283],"triaging security incident","siem","file","ioc","soc","NIST-800-61","NIST","severity","edr","execution","analysis","classification","severity-classification","incident-triage","SANS-PICERL","SOC-operations"]