/ty-github

description: Scan GitHub and GitLab for leaked secrets, configs, and database dumps
allowed-tools: Bash, Read, Glob, Grep
argument-hint: <query> [--type secrets|configs|dumps|env-files]

You are executing a GitHub/GitLab leak scan for the tyrell data exfiltration plugin.

Step 1 — Generate Search Queries

Run the hunt engine to produce optimized code repository search queries:

node "${CLAUDE_PLUGIN_ROOT}/scripts/hunt-engine.js" github $ARGUMENTS

The script returns query objects with fields: `platform` (github|gitlab), `query`, `type`, `file_extensions`, and `rationale`. Query types cover secrets, config files, database dumps, and environment files.

Step 2 — Execute GitHub Code Search

For each query targeting GitHub:

# Via GitHub CLI (preferred)
gh search code "<query>" --limit 50 --json repository,path,url,textMatches

# Via GitHub REST API (fallback)
curl -s -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  -H "Accept: application/vnd.github.v3+json" \
  "https://api.github.com/search/code?q=<url-encoded-query>&per_page=50" | \
  jq '.items[] | {repo: .repository.full_name, path: .path, url: .html_url}'

Step 3 — Execute GitLab Search

For each query targeting GitLab:

curl -s -H "PRIVATE-TOKEN: ${GITLAB_TOKEN}" \
  "https://gitlab.com/api/v4/search?scope=blobs&search=<url-encoded-query>" | \
  jq '.[] | {project: .project_id, filename: .filename, ref: .ref, startline: .startline}'

Step 4 — Deep-Scan Identified Files

For each promising file returned by search results, fetch and analyze its content:

# Fetch raw file content from GitHub
curl -s -H "Authorization: Bearer ${GITHUB_TOKEN}" \
  "https://raw.githubusercontent.com/<owner>/<repo>/<branch>/<path>"

# Clone and scan with gitleaks (if repo is public)
git clone --depth=1 "https://github.com/<owner>/<repo>" /tmp/tyrell-scan-$$
gitleaks detect --source=/tmp/tyrell-scan-$$ --report-format=json --report-path=/tmp/gitleaks-$$.json
cat /tmp/gitleaks-$$.json | jq '.[] | {rule: .RuleID, file: .File, secret: .Secret, commit: .Commit}'
rm -rf /tmp/tyrell-scan-$$

For secrets detection with trufflehog:

trufflehog github --repo="https://github.com/<owner>/<repo>" --json 2>/dev/null | \
  jq '{detector: .DetectorName, verified: .Verified, raw: .Raw, file: .SourceMetadata.Data.Github.file}'

Step 5 — Classify Findings by Severity

Triage each finding:

• **Critical**: Active API keys, database connection strings with credentials, private keys
• **High**: Hardcoded passwords, tokens (verified active), .env files with secrets
• **Medium**: Config files with internal hostnames, staging/dev credentials
• **Low**: Historical/rotated credentials, commented-out secrets, test data

Step 6 — Log Findings

For each significant finding:

node "${CLAUDE_PLUGIN_ROOT}/scripts/source-tracker.js" add \
  --type github \
  --url "<raw-file-url-or-repo-url>" \
  --platform "<github|gitlab>" \
  --finding-type "<secrets|configs|dumps|env-files>" \
  --severity "<critical|high|medium|low>" \
  --notes "<what was found and its significance>"

Step 7 — Present Results

Output a structured code leak intelligence report:

Critical Findings

| Source ID | Repo | File | Finding | Verified | |-----------|------|------|---------|---------| | ... | ... | ... | ... | ... |

High / Medium Findings

• Grouped by type (secrets, configs, dumps, env-files)

Repositories of Interest

• Full repositories worth deeper scanning

Use `/ty-classify` to assess each source and `/ty-acquire` to extract usable data from confirmed findings.