ai app secrets security auditor
Audit applications and agent workflows for exposed secrets, logging leaks, and over-privileged tool access.
$5
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+21 moreClaude CodeCursorCodex CLIMuseDots
Manus
Grok
Grok Bot+18 agentsai app secrets security auditor
Example session with this skill installed
Audit this Next.js snippet: I'm using an OpenAI key in a component and passing it to a server action. I also have a .env file with DATABASE_URL and STRIPE_SECRET.
- Read your context and instructions
- Compiled the ai app secrets
I have audited the described Next.js architecture and environment configuration. The current implementation contains a critical exposure risk regarding client-side credential handling.
Security Audit Report
| Finding | Severity | Location | Risk |
|---|---|---|---|
| Client-side Secret Exposure | CRITICAL | Frontend Component | API keys used in components are bundled into the browser, making them accessible to any user. |
| Potential Bundle Leakage | HIGH | .env / Webpack | DATABASE_URL could be exposed if imported into any file that eventually reaches the client-side tree. |
| Over-privileged Context | MEDIUM | Server Action | Passing raw keys from client to server increases the attack surface for prompt injection or interception. |
Exposure Inventory
- OpenAI API Key: Classified as COMPROMISED. It is present in the client-side component bundle.
- DATABASE_URL: Classified as AT RISK. Verification needed to ensure no client-side imports exist.
- STRIPE_SECRET: Classified as SECURE (assuming it is only accessed in
page.server.jsor API routes).
Remediation & Containment Plan
- Rotate Keys: Immediately revoke the current OpenAI API key. It must be considered public.
Move to Server-Side: Move the OpenAI logic into a Secure Server Action or API Route. Do not pass the key as a prop; fetch it from process.env strictly on the server.
3. Environment Hardening: Ensure DATABASE_URL and STRIPE_SECRET do not have the NEXT_PUBLIC_ prefix.
4. Validation: Use a server-only package import in your utility files to prevent accidental client-side imports.
Verification Checklist
- Confirm OpenAI key rotation in dashboard.
- Verify browser console/network tab does not show API keys during component render.
- Audit
package.jsonfor environment-related build scripts that might inject vars.
Next steps
- Move the OpenAI client initialization to a dedicated server-side utility file.
- Check your build logs to ensure no environment variables were printed during the last deployment.
- Implement a Secret Scanning tool in your CI/CD pipeline to catch future hardcoded keys.
Connects securely to your tools. The creator never sees your data.
About this skill
Hardcoded credentials and over-privileged agent tools create massive security holes that are often missed in standard code reviews. This skill audits your application architecture and agent workflows to identify exposed secrets, unsafe environment variable usage, and prompt leakage before they reach production.
What it does
- Secrets Inventory classifies every credential by environment and access level to identify scope creep.
- Exposure Tracing follows credentials from storage to runtime to detect leaks in logs, browser bundles, or client-side code.
- Risk Prioritization ranks findings by severity to focus containment efforts on high-impact vulnerabilities.
- Remediation Planning provides specific containment and rotation steps for compromised keys.
- Access Modeling evaluates agent tool permissions to ensure least-privilege enforcement.
How it works
- Analyze Inputs provided from architecture diagrams, code snippets, or environment configs.
- Trace Consumption paths to see if secrets are exposed to untrusted clients or LLM prompts.
- Generate Report featuring a security verdict, exposure inventory, and ranked findings.
- Define Verification steps to confirm that rotated credentials and new storage rules are secure.
Frameworks & tools
Works with any stack including Node.js, Python, React, and Next.js. Specialized for AI agent frameworks like LangChain, AutoGPT, or custom MCP implementations where tool-use permissions are critical.
Why this beats prompting it yourself
Standard prompts often miss the nuances of client-side bundling and log-sink exposure. This skill follows a rigorous trace-and-verify workflow that treats any client-side exposure as a compromise, ensuring no "soft" vulnerabilities are ignored.
Use cases
- Auditing a Next.js application for
NEXT_PUBLIC_prefixed secrets in client components. - Reviewing AI agent tools to prevent prompts from leaking API keys or database strings.
- Scanning deployment logs for accidental credential printing during CI/CD failures.
- Creating a containment plan after a suspected GitHub secret exposure.
Known limitations
Does not perform active penetration testing or live traffic monitoring. Relies on provided code snippets and architecture descriptions to identify flaws.
Does not perform active penetration testing or live traffic monitoring. Requires manual input of architecture or code snippets to analyze.
How to use
- 1
Connect your agent to the Agensi MCP
Copy the prompt and paste it into Claude, ChatGPT, Cursor or any agent that supports MCP. It sets up the connection for you. Manual setup
- 2
Sign in to Agensi
Your agent shows a sign-in link. Sign in and click Allow.
- 3
Ask for what you need
Your agent loads this skill and uses it on your task. It always asks before any payment.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill goes through the trust checks below.
Security scanned
Checked by our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scan
Security scan passed 1 month ago
Permissions
No special permissions declared or detected