Audit Security

Security Audit

Core Principle

Never read, echo, log, or surface secret values. All scanning is delegated to purpose-built tools that redact output by default. The agent's role is to orchestrate these tools and interpret their results, not to pattern-match secrets directly.

On-Start Security Insights

When invoked, run these checks and present a prioritized report (CRITICAL > WARNING > INFO):

1. Secret scan run gitleaks detect --no-banner on the working directory
2. File permissions check SSH keys, .env files for overly broad access
3. Git hygiene verify .gitignore covers .env*, *.pem, *.key, credentials.json
4. Open ports flag unexpected listeners via lsof -i -P -n | grep LISTEN
5. System posture FileVault status, firewall state, SIP status

Secret Scanning

Delegate entirely to external tools. Never grep for secret patterns directly.

| Tool | Usage | |------|-------| | gitleaks | gitleaks detect. Scan working tree; gitleaks protect. Pre-commit | | trufflehog | trufflehog filesystem .. Deep entropy + pattern scan | | git-secrets | git secrets --scan. AWS-focused pre-commit hook |

If none are installed, recommend installation and stop. Do not fall back to manual scanning.

Handling Findings

• Report file path and line number only. Never the secret value
• Recommend rotation immediately for any confirmed leak
• Check git history: gitleaks detect --log-opts="--all" for historical exposure

Git Safety

Verify before any commit:

• Run gitleaks protect --staged against staged changes
• Confirm .gitignore covers sensitive file patterns
• Flag large binaries or unexpected file types in staging

File Permission Audit

| Target | Expected | Check | |--------|----------|-------| | SSH private keys | 600 | stat -f '%Lp' ~/.ssh/id_* | | ~/.ssh/ directory | 700 | stat -f '%Lp' ~/.ssh | | .env files | 600 | stat -f '%Lp' .env* | | GPG keys | 600 | stat -f '%Lp' ~/.gnupg/private-keys-v1.d/* |

Report deviations. Offer to fix with chmod after user confirmation.

Process Investigation

When the user asks to diagnose system issues:

| Task | Command | |------|---------| | Top CPU consumers | ps -Ao pid,pcpu,comm -r \| head -20 | | Top memory consumers | ps -Ao pid,pmem,comm -m \| head -20 | | Listening ports | lsof -i -P -n \| grep LISTEN | | Network connections | lsof -i -n | | Open files by process | lsof -p | | Process detail | ps -p -o pid,ppid,user,%cpu,%mem,start,command | | Launch daemons | launchctl list | | Recent logins | last -10 |

Triage Flow

1. Identify symptom (high CPU, high memory, unexpected network, unknown process)
2. Isolate the process with ps / lsof
3. Check provenance. Signed? (codesign -v ) From a package manager?
4. Check network behavior. What IPs/domains is it contacting?
5. Recommend: ignore (benign), investigate further, or kill/remove

macOS-Specific

• lsof -i over netstat for richer output
• Check /Library/LaunchDaemons/ and ~/Library/LaunchAgents/ for persistence
• Code signatures: codesign --verify --deep --strict
• Gatekeeper: spctl --assess --type execute
• SIP status: csrutil status

Configuration Hardening

Verify and recommend:

• SSH: AddKeysToAgent yes, IdentitiesOnly yes
• GPG agent configured for commit signing
• Firewall: /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
• FileVault: fdesetup status
• Automatic updates enabled

Safe Defaults

• Never echo, log, or print secret values. Not even partially
• Never store secrets in shell history. Use op read, pass, or similar
• Pipe sensitive values directly: op read "op://vault/item" | command
• Prefer env vars over file-based secrets where tooling supports it

Output Format

## Security Audit Report

### CRITICAL
- [SECRET] gitleaks: finding in config/setup.sh:12 (rotate immediately)
- [PERMS] ~/.ssh/id_ed25519 has 644 (expected 600)

### WARNING
- [GIT] .env exists but not in .gitignore
- [PROCESS] Unknown process listening on port 8443

### INFO
- [OK] FileVault enabled
- [OK] SSH keys have correct permissions
- [OK] gitleaks: no findings in staged changes

Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

• Author: urmzd
• Source: urmzd/dotfiles
• License: Apache-2.0

Install and usage instructions live in the source repository linked above.