Hunt Secrets — Development skill for Claude Code
Hunt leaked credentials for an ingested program (verified-only trufflehog + GH code search + noseyparker historical).
How to install Hunt Secrets
Installs to ~/.claude/commands/kennyalfredo-pr-agent-hunt-secrets.md
mkdir -p ~/.claude/commands && curl -fsSL https://raw.githubusercontent.com/Kennyalfredo/pr-agent/HEAD/.claude/commands/hunt-secrets.md -o ~/.claude/commands/kennyalfredo-pr-agent-hunt-secrets.md Restart Claude Code, or start a new session, for it to be picked up.
What Hunt Secrets does
description: Hunt leaked credentials for an ingested program (verified-only trufflehog + GH code search + noseyparker historical). Writes redacted candidates to out//secrets/.json. Does NOT verify the secret is owned by the program — that's the next step. argument-hint: allowed-tools: Agent
You are kicking off leaked-credential hunting for program slug: $ARGUMENTS
Delegate to the `secret-hunter` subagent. Pass the slug and require it to:
- Read `memory/program
Alternatives in Development
- Agentlas Search — Search Agentlas Cloud and Hub agent candidates without invoking 1.1k ★
- Claudecode — Open Source ClaudeCode Leaked 1k ★
- Opencode Claude Auth — OpenCode plugin that uses your existing Claude Code credentials — no separate login needed 903 ★
Full documentation available on GitHub
View Source RepositoryRelated Skills
Hunt Buckets
Enumerate cloud buckets for an ingested program (listing-only, no GetObject). Writes candidates to out/ /bucke
Hunt Takeovers
Enumerate subdomain-takeover candidates for an ingested program (passive subfinder + dnsx CNAME + subzy finger
Clawctl
Drive openclaw via the clawctl wrapper. Read-only by default, JSON-first, traceparent on every call, secrets r
Codeword Silly Goose
A Claude skill that catches leaked secrets, refuses to repeat them, and calls you a silly goose until you rota
0x002132 Skills Bugbounty Hunt Ato
Hunt account takeover taxonomy — 9 distinct paths to ATO, plus chains. Paths: (1) password reset flaws (host h
CryptEnv
A local-first encrypted secrets vault for developers. API keys, credentials, commands and links — accessible w
Related Agents
Secret Hunter
Hunts publicly-leaked credentials (API tokens, cloud keys, DB strings) that belong to a previously-ingested pr
Secret Purist
The paranoid sentinel of credential security. Use this agent to scan codebases and git history for leaked secr
Opensource Sanitizer
Pre-public-push safety net. Scans a diff or working tree for leaked secrets, PII, internal references, interna