Decide Fit First

• Core job: Gitleaks is an open-source SAST tool for detecting hardcoded secrets like passwords, API keys, and tokens in Git repositories, f…
• Best fit: Use it when the task has reusable inputs, steps, and validation criteria rather than a one-off answer.
• Avoid forcing it: If the source lacks commands, platform support, or external-service evidence, keep those fields unknown instead of guessing.

Design Intent

• Structure: The skill is organized around “Installation”, “Source”, showing how the author expects the agent to judge fit, collect context, and produce verifiable output.
• Trigger evidence: Prioritize the author’s wording around when to use it, what context to collect, and what output shape to produce.
• Evidence boundary: Author text states facts, repository files prove commands and paths, and Fluxly only adds fit, limits, and usage judgment.

How To Use It

• Inputs: Provide target material, scope, expected result, forbidden changes, and validation method.
• Invocation: Name gitleaks-git-repository-secret-scanner directly; if the source includes slash commands, start with the command and then add task context.
• Validation: Start small and check whether the result follows “Installation / Source” before expanding.

Boundaries And Review

• Dependencies: It usually needs no extra API key, so start with a small validation task.
• Permissions: Declared permissions include read; ask the agent to state file, command, and rollback boundaries before acting.
• Quality bar: A useful result names the deliverable, evidence, and next action. Generic prose means the task needs tighter context.