/kingfisher

name: kingfisher
description: Find, live-validate, map the blast radius of, and revoke leaked secrets with Kingfisher (MongoDB) — across a local repo, Git history, a GitHub/GitLab/Bitbucket org, S3/GCS, Docker images, Slack, Jira, Confluence, Teams, or Postman. Covers local CLI scanning, direct validate/revoke without a scan, baseline management (track only new secrets), kingfisher.yaml policy, CI diff-scan gates, and pre-commit/Husky hooks. Use when asked to "scan for secrets", "is this key still live", "what can this credential reach", "revoke this token", "did we leak a secret", or "block new secrets in CI". Pattern-only secret scan bundled with a CVE pass → /platform-skills:trivy. Secrets-context safety in workflow YAML → /platform-skills:zizmor. Storing/rotating secrets inside the cluster → /platform-skills:secrets.
argument-hint: "[scan|audit|validate|revoke|baseline|triage|config|ci|precommit|explain] [target|finding]"
title: "Kingfisher Command"
sidebar_label: "kingfisher"
custom_edit_url: null

Find a leaked secret, prove whether it's still alive, see what it can reach, and kill it — in that order.

Read `references/kingfisher.md` before responding. It contains bootstrap steps, the full CLI surface (scan, validate, revoke, baseline, config), the `kingfisher.yaml` schema, platform-target commands with their auth env vars, exit-code semantics, CI templates, and the pre-commit/Husky setup.

**This command is interactive by default.** With no arguments, run the three-layer wizard below. Never dump a raw `kingfisher scan` invocation and stop — the useful output is a validated, triaged verdict, not a wall of candidate strings.

Ownership boundary (enforced at the menu)

| Question | Authoritative command | |---|---| | "Is there a hardcoded-looking secret in this repo?" (fast, offline, bundled with a CVE scan) | `/platform-skills:trivy` `secrets` mode | | "Is that secret still **live**? What can it reach? Kill it." | **this command** | | "Did a secret leak into Slack, Jira, Confluence, S3, or a whole GitHub org — not just one repo?" | **this command** | | "How should secrets be stored/rotated *inside* my cluster?" | `/platform-skills:secrets` | | "Is my workflow's `secrets:` context usage safe?" | `/platform-skills:zizmor` | | "Is there a CVE in my image or dependencies?" | `/platform-skills:trivy` | | "How do I sign images / generate an SBOM?" | `/platform-skills:supply-chain` |

Trivy's `secrets` scanner and Kingfisher are not the same depth of tool: Trivy tells you a string *matches a pattern*, offline, as part of a broader vuln/license scan. Kingfisher live-validates the candidate against the real provider, tells you if it's actually dangerous, and can map or kill it. Run both if you want a cheap first pass and a specialist second pass — they are not redundant.

---

Mode dispatch

Parse the first word of `$ARGUMENTS` as the mode. When `$ARGUMENTS` is empty, run the three-layer interactive wizard.

| Mode | What it does | |---|---| | `scan` | Default local/repo run, live validation on — the everyday check | | `audit` | Deep sweep for a security review: low confidence, full history, blast-radius, all outcomes | | `validate` | Check whether one known secret string is still live — no scan | | `revoke` | Kill one known secret directly through its provider — destructive, confirm first | | `baseline` | Create or update a baseline so future scans report only new secrets | | `triage` | Walk existing findings one at a time → validate / revoke / rotate / accept-in-baseline / false-positive | | `config` | Generate or repair `kingfisher.yaml` | | `ci` | Emit a CI gate: hard-fail, SARIF alerts, or Docker-based | | `precommit` | Add the `kingfisher-auto` pre-commit hook (or Husky) and state the caveat | | `explain` | Explain a rule id, an exit code, or a validation outcome | | _(empty)_ | Three-layer interactive wizard |

---

Three-layer interactive wizard

Layer 1 — Developer question (intent in their language)

What are you trying to find out?
  1. "Did we commit a secret? Check my repo."        → scan
  2. "Full sweep — I'm doing a security review."      → audit
  3. "I have a key from somewhere — is it still live?" → validate
  4. "Kill this credential now."                       → revoke
  5. "Only show me new secrets, not the old backlog."  → baseline
  6. "I have findings — help me decide what to do."    → triage
  7. "Set up a kingfisher.yaml for this repo."         → config
  8. "Make this a check on every PR."                  → ci
  9. "Catch it before I even commit."                  → precommit
  10. "What does this finding/exit code mean?"          → explain

  Pattern-only secret scan bundled with a CVE pass? → /platform-skills:trivy
  Workflow secrets: context usage?                  → /platform-skills:zizmor
  Storing/rotating secrets inside the cluster?       → /platform-skills:secrets

Enter 1–10 or a mode name:

Layer 2 — Scope and target (decides what actually gets scanned, and how invasively)

Ask only what the chosen mode needs.

What should I scan? (press Enter for the recommended value)

  • Target [.]: local path, a Git URL, or a platform target —
    github/gitlab/bitbucket/gitea/azure/huggingface org or user,
    s3/gcs bucket, docker image, jira/confluence/slack/teams/postman search.
    Platform targets need an auth token env var (KF_GITHUB_TOKEN, etc.) —
    see references/kingfisher.md → Platform-specific targets.

  • History [working tree + history]: local paths scan both by default,
    which double-counts anything still present in a tracked file (once from
    the file, once from the commit it entered on). `--git-history=none`
    scans the working tree only; a remote URL target is history-only by
    default (bare clone).

  • Live validation [on]: confirms whether each candidate still
    authenticates. `--no-validate` is faster but static-only — you get
    "looks like a key," not "is a key." Keep this on unless you're