SECURITY / Infisical Inc.
Infisical secret scanning
Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten.
“Walks through a baseline scan, triage, ignore rules, and honey tokens, and says a GitHub App connection named github is the wrong type.”
01 / THE REASONING
Why this made the selection.
- The catalogue has a Vault MCP server and no Infisical secret-scanning skill.
- The file distinguishes scanning from secret storage and from rotation, which it points at other skills.
02 / THE REVIEW RECORD
What we actually inspected.
Source review has boundaries.
A clear record is more useful than a “safe” badge.
Material inspected
- skills/infisical-secret-scanning/SKILL.md
- README.md
- LICENSE
Our findings
- The skill says GitHub scanning needs a github-radar App Connection, not a connection whose value is github.
- It says to rotate a leaked credential before cleaning history, because rewriting history does not un-leak it.
- It prefers .infisicalignore and infisical-scan:ignore over disabling rules, and it points storage and rotation at other skills that were not reviewed here.
Not established by this review
- The skill was not executed.
- No repository was scanned.
- No Infisical API call was made.
The review applies to the material and revision named here. A newer upstream release can change its behavior.
03 / PUT IT TO WORK
Add a skill to your workflow.
DOCUMENTED COMMAND
npx skills add Infisical/ai-skillsRun in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above.
- The README gives that command for the skills.
- A separate docs MCP line, claude mcp add --transport http infisical-docs https://infisical.com/docs/mcp, is not the skill installer.
Before you start
- A skills-compatible agent
- An Infisical project when a cloud data source is connected
- The infisical scan CLI for the local history workflow
04 / FOLLOW THE EVIDENCE
The source trail.
Our notes are separate from the original resource.
Check upstream before adopting a new version.
https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-secret-scanning/SKILL.md
Supports: github-radar rule and rotation-before-rewrite
- MIT LICENSE ↗Checked
https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE
Supports: MIT grant
- README ↗Checked
https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md
Supports: skills install line, distinct from the docs MCP