# Audit Security

> Scans a repo and host for leaked keys and secrets (gitleaks, trufflehog), audits SSH/GPG/.env file permissions, checks git hygiene, investigates suspicious processes and listeners, and hardens config (FileVault, firewall, SIP, SSH). Use when auditing for leaked credentials or secrets, checking for security issues before a commit, investigating an unknown process or open port, or hardening a machi…

- **Type:** Skill
- **Install:** `agentstack add skill-urmzd-dotfiles-audit-security`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [urmzd](https://agentstack.voostack.com/s/urmzd)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [urmzd](https://github.com/urmzd)
- **Source:** https://github.com/urmzd/dotfiles/tree/main/dot_agents/skills/audit-security

## Install

```sh
agentstack add skill-urmzd-dotfiles-audit-security
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Security Audit

## Core Principle

Never read, echo, log, or surface secret values. All scanning is delegated to purpose-built tools that redact output by default. The agent's role is to orchestrate these tools and interpret their results, not to pattern-match secrets directly.

## On-Start Security Insights

When invoked, run these checks and present a prioritized report (CRITICAL > WARNING > INFO):

1. **Secret scan** run `gitleaks detect --no-banner` on the working directory
2. **File permissions** check SSH keys, `.env` files for overly broad access
3. **Git hygiene** verify `.gitignore` covers `.env*`, `*.pem`, `*.key`, `credentials.json`
4. **Open ports** flag unexpected listeners via `lsof -i -P -n | grep LISTEN`
5. **System posture** FileVault status, firewall state, SIP status

## Secret Scanning

Delegate entirely to external tools. Never grep for secret patterns directly.

| Tool | Usage |
|------|-------|
| [gitleaks](https://github.com/gitleaks/gitleaks) | `gitleaks detect`. Scan working tree; `gitleaks protect`. Pre-commit |
| [trufflehog](https://github.com/trufflesecurity/trufflehog) | `trufflehog filesystem .`. Deep entropy + pattern scan |
| git-secrets | `git secrets --scan`. AWS-focused pre-commit hook |

If none are installed, recommend installation and stop. Do not fall back to manual scanning.

### Handling Findings

- Report file path and line number only. Never the secret value
- Recommend rotation immediately for any confirmed leak
- Check git history: `gitleaks detect --log-opts="--all"` for historical exposure

## Git Safety

Verify before any commit:

- Run `gitleaks protect --staged` against staged changes
- Confirm `.gitignore` covers sensitive file patterns
- Flag large binaries or unexpected file types in staging

## File Permission Audit

| Target | Expected | Check |
|--------|----------|-------|
| SSH private keys | `600` | `stat -f '%Lp' ~/.ssh/id_*` |
| `~/.ssh/` directory | `700` | `stat -f '%Lp' ~/.ssh` |
| `.env` files | `600` | `stat -f '%Lp' .env*` |
| GPG keys | `600` | `stat -f '%Lp' ~/.gnupg/private-keys-v1.d/*` |

Report deviations. Offer to fix with `chmod` after user confirmation.

## Process Investigation

When the user asks to diagnose system issues:

| Task | Command |
|------|---------|
| Top CPU consumers | `ps -Ao pid,pcpu,comm -r \| head -20` |
| Top memory consumers | `ps -Ao pid,pmem,comm -m \| head -20` |
| Listening ports | `lsof -i -P -n \| grep LISTEN` |
| Network connections | `lsof -i -n` |
| Open files by process | `lsof -p ` |
| Process detail | `ps -p  -o pid,ppid,user,%cpu,%mem,start,command` |
| Launch daemons | `launchctl list` |
| Recent logins | `last -10` |

### Triage Flow

1. Identify symptom (high CPU, high memory, unexpected network, unknown process)
2. Isolate the process with `ps` / `lsof`
3. Check provenance. Signed? (`codesign -v `) From a package manager?
4. Check network behavior. What IPs/domains is it contacting?
5. Recommend: ignore (benign), investigate further, or kill/remove

### macOS-Specific

- `lsof -i` over `netstat` for richer output
- Check `/Library/LaunchDaemons/` and `~/Library/LaunchAgents/` for persistence
- Code signatures: `codesign --verify --deep --strict `
- Gatekeeper: `spctl --assess --type execute `
- SIP status: `csrutil status`

## Configuration Hardening

Verify and recommend:

- SSH: `AddKeysToAgent yes`, `IdentitiesOnly yes`
- GPG agent configured for commit signing
- Firewall: `/usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate`
- FileVault: `fdesetup status`
- Automatic updates enabled

## Safe Defaults

- Never echo, log, or print secret values. Not even partially
- Never store secrets in shell history. Use `op read`, `pass`, or similar
- Pipe sensitive values directly: `op read "op://vault/item" | command`
- Prefer env vars over file-based secrets where tooling supports it

## Output Format

```text
## Security Audit Report

### CRITICAL
- [SECRET] gitleaks: finding in config/setup.sh:12 (rotate immediately)
- [PERMS] ~/.ssh/id_ed25519 has 644 (expected 600)

### WARNING
- [GIT] .env exists but not in .gitignore
- [PROCESS] Unknown process listening on port 8443

### INFO
- [OK] FileVault enabled
- [OK] SSH keys have correct permissions
- [OK] gitleaks: no findings in staged changes
```

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [urmzd](https://github.com/urmzd)
- **Source:** [urmzd/dotfiles](https://github.com/urmzd/dotfiles)
- **License:** Apache-2.0

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-urmzd-dotfiles-audit-security
- Seller: https://agentstack.voostack.com/s/urmzd
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.