Audit security

Skill urmzd/dotfiles/dot_agents/skills/audit-security

Cross-platform dotfiles managed by Chezmoi with Homebrew/apt and per-language version managers. One-command bootstrap for macOS and Linux with Neovim, Tmux, Zsh, and AI agent skills.

Install

npx -y skills add urmzd/dotfiles --skill audit-security

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

2 stars2 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Scans a repo and host for leaked keys and secrets (gitleaks, trufflehog), audits SSH/GPG/.env file permissions, checks git hygiene, investigates suspicious processes and listeners, and hardens config (FileVault, firewall, SIP, SSH). Use when auditing for leaked credentials or secrets, checking for security issues before a commit, investigating an unknown process or open port, or hardening a machine. Do NOT use for storing, injecting, or rotating secrets at rest (1Password, op read, vaults) -> use manage-secrets; this skill only detects and reports exposure.

SKILL.md

5.1 KB, as published. Nobody here has run it

Security Audit

Core Principle

Never read, echo, log, or surface secret values. All scanning is delegated to purpose-built tools that redact output by default. The agent's role is to orchestrate these tools and interpret their results, not to pattern-match secrets directly.

On-Start Security Insights

When invoked, run these checks and present a prioritized report (CRITICAL > WARNING > INFO):

Secret scan run gitleaks detect --no-banner on the working directory
File permissions check SSH keys, .env files for overly broad access
Git hygiene verify .gitignore covers .env*, *.pem, *.key, credentials.json
Open ports flag unexpected listeners via lsof -i -P -n | grep LISTEN
System posture FileVault status, firewall state, SIP status

Secret Scanning

Delegate entirely to external tools. Never grep for secret patterns directly.

Tool	Usage
gitleaks	`gitleaks detect`. Scan working tree; `gitleaks protect`. Pre-commit
trufflehog	`trufflehog filesystem .`. Deep entropy + pattern scan
git-secrets	`git secrets --scan`. AWS-focused pre-commit hook

If none are installed, recommend installation and stop. Do not fall back to manual scanning.

Handling Findings

Report file path and line number only. Never the secret value
Recommend rotation immediately for any confirmed leak
Check git history: gitleaks detect --log-opts="--all" for historical exposure

Git Safety

Verify before any commit:

Run gitleaks protect --staged against staged changes
Confirm .gitignore covers sensitive file patterns
Flag large binaries or unexpected file types in staging

File Permission Audit

Target	Expected	Check
SSH private keys	`600`	`stat -f '%Lp' ~/.ssh/id_*`
`~/.ssh/` directory	`700`	`stat -f '%Lp' ~/.ssh`
`.env` files	`600`	`stat -f '%Lp' .env*`
GPG keys	`600`	`stat -f '%Lp' ~/.gnupg/private-keys-v1.d/*`

Report deviations. Offer to fix with chmod after user confirmation.

Process Investigation

When the user asks to diagnose system issues:

Task	Command
Top CPU consumers	`ps -Ao pid,pcpu,comm -r \| head -20`
Top memory consumers	`ps -Ao pid,pmem,comm -m \| head -20`
Listening ports	`lsof -i -P -n \| grep LISTEN`
Network connections	`lsof -i -n`
Open files by process	`lsof -p <PID>`
Process detail	`ps -p <PID> -o pid,ppid,user,%cpu,%mem,start,command`
Launch daemons	`launchctl list`
Recent logins	`last -10`

Triage Flow

Identify symptom (high CPU, high memory, unexpected network, unknown process)
Isolate the process with ps / lsof
Check provenance. Signed? (codesign -v <path>) From a package manager?
Check network behavior. What IPs/domains is it contacting?
Recommend: ignore (benign), investigate further, or kill/remove

macOS-Specific

lsof -i over netstat for richer output
Check /Library/LaunchDaemons/ and ~/Library/LaunchAgents/ for persistence
Code signatures: codesign --verify --deep --strict <binary>
Gatekeeper: spctl --assess --type execute <binary>
SIP status: csrutil status

Configuration Hardening

Verify and recommend:

SSH: AddKeysToAgent yes, IdentitiesOnly yes
GPG agent configured for commit signing
Firewall: /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
FileVault: fdesetup status
Automatic updates enabled

Safe Defaults

Never echo, log, or print secret values. Not even partially
Never store secrets in shell history. Use op read, pass, or similar
Pipe sensitive values directly: op read "op://vault/item" | command
Prefer env vars over file-based secrets where tooling supports it

Output Format

## Security Audit Report

### CRITICAL
- [SECRET] gitleaks: finding in config/setup.sh:12 (rotate immediately)
- [PERMS] ~/.ssh/id_ed25519 has 644 (expected 600)

### WARNING
- [GIT] .env exists but not in .gitignore
- [PROCESS] Unknown process listening on port 8443

### INFO
- [OK] FileVault enabled
- [OK] SSH keys have correct permissions
- [OK] gitleaks: no findings in staged changes