--- title: "Infisical secret scanning: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/infisical-secret-scanning/ description: "Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten." --- # Infisical secret scanning: review, setup & limitations · Undominated.ai > Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten. [← Explore all skills](/skills/) SECURITY / Infisical Inc. # Infisical secret scanning Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/Infisical/ai-skills/tree/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-secret-scanning) SOURCE REVIEW Reviewed 2026-10-14 Evidence 3 linked sources Publisher Infisical Inc. Licence [MIT ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE) Revision d7e7fa443893 [Read what was—and wasn’t—checked ↓](#review) “Walks through a baseline scan, triage, ignore rules, and honey tokens, and says a GitHub App connection named github is the wrong type.” [Infisical Inc. · upstream description ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-secret-scanning/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The catalogue has a Vault MCP server and no Infisical secret-scanning skill. - The file distinguishes scanning from secret storage and from rotation, which it points at other skills. ### A good fit for - Connecting a repository for a baseline secret scan - Reducing scanner noise without turning a rule off ### Weigh up before choosing - This review did not execute the skill or infisical scan. - scanning-and-findings.md and cli-and-honey-tokens.md were not fetched. - The docs MCP command in the README is a different product and is not this skill's installer. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/infisical-secret-scanning/SKILL.md - README.md - LICENSE ### Our findings - The skill says GitHub scanning needs a github-radar App Connection, not a connection whose value is github. - It says to rotate a leaked credential before cleaning history, because rewriting history does not un-leak it. - It prefers .infisicalignore and infisical-scan:ignore over disabling rules, and it points storage and rotation at other skills that were not reviewed here. ### Not established by this review - The skill was not executed. - No repository was scanned. - No Infisical API call was made. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md) DOCUMENTED COMMAND npx skills add Infisical/ai-skills Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. - The README gives that command for the skills. - A separate docs MCP line, claude mcp add --transport http infisical-docs https://infisical.com/docs/mcp, is not the skill installer. ### Before you start - A skills-compatible agent - An Infisical project when a cloud data source is connected - The infisical scan CLI for the local history workflow ### Compatibility skills CLI · Infisical · GitHub · GitLab · Bitbucket ### Reads git history and scan findings - Scan git history, working trees, and configured cloud repos - Triage findings as resolved, false positive, or ignored - Create honey tokens only when that referenced workflow is followed ### Cost model MIT, copyright 2026 Infisical Inc.; an Infisical account is required for the cloud data sources 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [infisical-secret-scanning SKILL.md ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-secret-scanning/SKILL.md) Checked 2026-10-14 https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-secret-scanning/SKILL.md Supports: github-radar rule and rotation-before-rewrite - [MIT LICENSE ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE) Checked 2026-10-14 https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE Supports: MIT grant - [README ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md) Checked 2026-10-14 https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md Supports: skills install line, distinct from the docs MCP KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Dependabot ↗ Configures and manages Dependabot end to end: ecosystem detection across 25+ package managers, monorepo glob directories, grouped and multi-ecosystem updates, cooldown periods, ignore and allow rules, and PR command etiquette including the January 2026 deprecations.](/skills/github-dependabot/)[### Infisical PKI ↗ Pins Infisical's certificate-management skill and its rule to send SSH certificates to a different skill.](/skills/infisical-pki/)[### Secret Serialization Review ↗ Finds a credential field that survives generated serialization, and the sink that stringifies the whole object.](/skills/getsentry-secret-serialization/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)