SkillsAdd

jd-opensource/joysafeter

pentest-secrets-exposure

Discover hardcoded credentials, leaked API keys, exposed configuration files, sensitive data in artifacts, and information disclosure via error handling.

First seen Feb 18, 2026

Installation

$ npx skills add jd-opensource/joysafeter --skill pentest-secrets-exposure
View on skills.sh ↗ GitHub repository ↗

Similar popular skills

Related neighbors and high-traction skills in the same topics — useful to compare before installing.

agent-browser Same topic
vercel-labs/agent-browser

Browser automation CLI for AI agents. Use when the user needs to interact with websites, includ…

810.4K installs
azure-diagnostics Same topic
microsoft/azure-skills

Debug Azure production issues on Azure using AppLens, Azure Monitor, resource health, and safe …

568.9K installs
azure-validate Same topic
microsoft/azure-skills

Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure…

567.7K installs
azure-aigateway Same topic
microsoft/azure-skills

Configure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: sem…

566.3K installs
azure-compute Same topic
microsoft/azure-skills

Azure VM/VMSS router. WHEN: create / provision / deploy / spin-up VM, recommend VM size, compar…

510K installs
supabase-postgres-best-practices Same topic
supabase/agent-skills

Postgres best practices maintained by Supabase, for Postgres running anywhere. Load this skill …

391.6K installs

Also in this package

Other skills from jd-opensource/joysafeter · top by installs.

npx skills add jd-opensource/joysafeter
pentest-osint-recon 152 pentest-api-deep 80 pentest-mobile-app 78 pentest-exploit-validation 74 pentest-ai-llm-security 73 pentest-ctf-binary 69 pentest-whitebox-code-review 63 pentest-network-internal 63 pentest-config-hardening 60 pentest-race-conditions 60

Browse all from jd-opensource/joysafeter

More details

Agent compatibility

Declared targets from SKILL.md / docs. Unmarked agents are not listed — the skill may still install via the CLI.

Claude Code Not declared
Cursor Not declared
Codex Not declared
GitHub Copilot Not declared
Windsurf Not declared
Gemini CLI Not declared
Cline Not declared
OpenCode Not declared

Repository health

Stars 305
License LICENSE
Default branch main
Open issues 16
Status Active

Package contents

Files included with this skill beyond the listing page.

  • skill md SKILL.md 2,926 B
  • docs SUMMARY.md 185 B

History

  1. First seen on skills.sh
  2. First recorded snapshot · 65 installs

SKILL.md

Pentest Secrets Exposure

Purpose

Spans multiple unchecked WSTG categories — CONF-03/04 (sensitive files, backups), INFO-05 (info leakage), ERRH-01/02 (error handling, stack traces). Shannon's pre-recon focuses on architecture, not systematic secrets discovery.

Prerequisites

Authorization Requirements

  • Written authorization with source code access scope (if white-box)
  • Git repository access for history mining (if applicable)
  • Target URL list for exposed file probing

Environment Setup

  • TruffleHog for git history secret scanning
  • GitLeaks for pattern-based secret detection
  • Semgrep with secrets ruleset
  • nuclei with exposure templates

Core Workflow

  1. Source Code Secrets: Scan for hardcoded API keys, DB credentials, JWT signing keys, encryption keys using pattern + entropy detection.
  2. Git History Mining: Search all commits for secrets added then removed. Check force-pushed branches. Analyze .gitignore for sensitive patterns.
  3. Exposed Config Files: Probe for .env, .git/config, .DS_Store, wp-config.php, application.yml, docker-compose.yml with credentials (WSTG-CONF-03/04).
  4. Error Handling Disclosure: Trigger stack traces, debug pages, verbose errors revealing internal paths, DB schemas, framework versions (WSTG-ERRH-01/02).
  5. Backup & Unreferenced Files: .bak, .old, .swp, ~files, editor temp files, DB dumps, log files with sensitive data.
  6. Client-Side Bundle Analysis: Extract API keys from JS bundles, source maps exposing server code, hardcoded tokens in mobile packages.
  7. Secret Validation: Test each discovered credential for active access, document scope, assess blast radius.

WSTG Coverage

WSTG ID Test Name Status
WSTG-CONF-03 Test File Extensions Handling for Sensitive Info ✅
WSTG-CONF-04 Review Old Backup and Unreferenced Files ✅
WSTG-INFO-05 Review Webpage Content for Information Leakage ✅
WSTG-ERRH-01 Test Improper Error Handling ✅
WSTG-ERRH-02 Test Stack Traces ✅

Tool Categories

Category Tools Purpose
Git Scanning TruffleHog, GitLeaks Secret detection in git history
Static Analysis Semgrep (secrets rules), grep patterns Source code secret scanning
Web Probing nuclei (exposure templates), ffuf Exposed file/config discovery
JS Analysis SecretFinder, LinkFinder Client-side bundle secret extraction
Validation curl, custom scripts Credential active-access testing

References

  • references/tools.md - Tool function signatures and parameters
  • references/workflows.md - Attack pattern definitions and test vectors