Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
OpenClaw+21 moreClaude CodeCursorCodex CLIMuseOpenClaw
Manus
Grok
Grok Bot+18 agentsSecurity Secrets & Dependency Audit — Leak Risk, Attack Path
The problem Scanner dumps list “possible secrets” without saying what the business loses or what an attacker would do next.
$15
Security Secrets & Dependency Audit — Leak Risk, Attack Path
Example session with this skill installed
Mode: Gate (publish Apache-2.0 next week)
Repo: glacier-archive-worker — Go media archive indexer (university)
Surfaces
- docker-compose.override.yml with R2-style access key pair + prod bucket name (~5 months in git)
- helm/glacier/values-prod.yaml with smtps://apikey:SG.…@smtp… embedded
- worker.example.toml YOUR_R2_ACCESS_KEY_HERE (placeholder)
- docs/setup.md glpat-ExamplePlaceholderToken0000 (placeholder)
- go.mod: gopkg.in/yaml.v2 v2.2.8, golang.org/x/net v0.7.0
Ask: go/no-go for open-source; mask all secrets; do not modify the repo.
- Read your context and instructions
- Compiled the security secrets
- Generated the document
Security Secrets & Dependency Audit
1. Assessment Summary
| Field | Value |
|---|---|
| Repo | glacier-archive-worker |
| Mode | Gate (pre-open-source) |
| Threat model | Object-store + SMTP + researcher emails — high if keys real |
| Secrets | 4 (2 critical patterns / 2 placeholders) |
| Dependencies | 2 (verify via govulncheck) |
| Maturity | CRITICAL-EXPOSURE |
| Open-source gate | NO-GO |
2–3. Threat model & surfaces
Research media store + institutional email identity. Compose, Helm, docs, go.mod scanned.
Placeholders filtered; compose + Helm fail Gate.
4. Secrets (masked only)
| ID | Where | Masked | Class | Severity |
|---|---|---|---|---|
| SEC-01 | docker-compose.override.yml | AKIA**** / wJal**** | needs-review → treat compromised | CRI |
| SEC-02 | helm values-prod | SG.**** in SMTP URL | real-pattern | CRITICAL |
| SEC-03 | example.toml | YOUR_R2_**** | placeholder | INFO |
| SEC-04 | docs/setup.md | glpat-**** | placeholder | INFO |
Lifecycle: SEC-01 ~5 months in remote history — rotation required even if file is deleted.
5. Dependencies
DEP-01 yaml.v2@v2.2.8 — outdated; verify advisories / upgrade
DEP-02 x/net@v0.7.0 — outdated; govulncheck before release
(No invented CVE IDs.)
6–7. Attack paths & business impact
- Open-source × SEC-01 → keys tried against research bucket
- SEC-02 → send-as phishing
- SEC-01 + reachable parser issue (if confirmed) → chained host impact
Priority: SEC-01, SEC-02, then deps.
8–9. First hour + roadmap
Rotate object-store + SMTP keys now → audit provider logs → assume history leaked →
externalize Helm secrets → govulncheck upgrades → pre-commit/CI gates → re-run Gate.
10–13. Prevention, confidence, maturity
Layers: pre-commit → CI → secrets manager → no tracked overrides → Renovate/govulncheck.
Verdict CRITICAL-EXPOSURE until critical secrets gone; then HIGH-RISK → MODERATE → CLEAN path.
Static only — not a pen test.
14. JSON
Full Audit JSON with masked_value fields, attack_paths, remediation_roadmap, assumptions.
security-secrets-dependency-audit-leak-r.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
The problem
- Scanner dumps list “possible secrets” without saying what the business loses or what an attacker would do next.
- Credentials in Docker Compose overrides, Helm values, and CI history survive long after a file is “fixed.”
- Dependency noise (dev-only, unreachable) drowns out reachable, high-impact issues.
- Teams open-source or share repos without a clear go/no-go gate.
What it does
- Scopes a threat model (what the system protects and why findings matter).
- Scans major leak surfaces: source, config, .env, IaC, CI/CD, Docker, Helm/k8s, docs, fixtures.
- Classifies secrets as real / placeholder / needs-review and masks values (e.g.
AKIA****MPLE). - Adds secret lifecycle: age, git history, remote exposure, environment.
- Weights dependencies by severity, reachability, exploitability, maintainer health, and license.
- Builds attack paths and a business-impact order.
- Delivers first-hour response, remediation roadmap, prevention layers, and a maturity verdict with a path up.
Frameworks & tools
- Works across Node, Python, Go, containers, Helm, and common package manifests (
package.json,go.mod,requirements.txt, etc.). - Modes: Audit, Incident, Gate (pre-release/open-source), Compare (baseline).
- Compatible with Claude Code, Cursor, Codex CLI, OpenClaw — file-read only for the assessment itself.
Why this beats prompting it yourself
- False-positive discipline so
YOUR_KEY_HEREdoes not page the same as a live key. - Lifecycle thinking: history and remotes matter more than “file deleted.”
- Attack paths, not flat lists.
- Explicit open-source / release Gate verdict.
- Safety-by-design: no full secret dump in the report.
- Honest coverage map when advisories were not machine-verified.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 1 month ago
- Passed all security checks, Safe to install