Security audit
Security checks for vulnerabilities and agentic risk
This is a reference skill for age encryption; the sensitive-looking commands are printed examples, not automatically executed behavior.
Install only if you want an age encryption command reference. Treat the examples as powerful shell snippets: review paths, recipients, private keys, .env files, and cloud bucket destinations before running or asking an agent to run them.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
├────────────────┼────────────────┼────────────────┤
│ Key format │ X25519 │ RSA/DSA/ECC │
│ Config needed │ None │ ~/.gnupg/ │
│ Key management │ Just files │ Keyring/server │
│ Trust model │ None │ Web of Trust │
│ Signing │ No │ Yes │
│ Key size │ 62 chars │ Variable │
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- ssh-rsa (2048+ bits)
# Encrypt to SSH key
age -R ~/.ssh/id_ed25519.pub -o secret.age plaintext.txt
# Decrypt with SSH private key
age -d -i ~/.ssh/id_ed25519 -o plaintext.txt secret.age
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- ssh-rsa (2048+ bits)
# Encrypt to SSH key
age -R ~/.ssh/id_ed25519.pub -o secret.age plaintext.txt
# Decrypt with SSH private key
age -d -i ~/.ssh/id_ed25519 -o plaintext.txt secret.age
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- ssh-rsa (2048+ bits)
# Encrypt to SSH key
age -R ~/.ssh/id_ed25519.pub -o secret.age plaintext.txt
# Decrypt with SSH private key
age -d -i ~/.ssh/id_ed25519 -o plaintext.txt secret.age
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- ssh-rsa (2048+ bits)
# Encrypt to SSH key
age -R ~/.ssh/id_ed25519.pub -o secret.age plaintext.txt
# Decrypt with SSH private key
age -d -i ~/.ssh/id_ed25519 -o plaintext.txt secret.age
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cat largefile.bin | gzip | age -r age1recipient... -o largefile.gz.age
# Encrypt then base64 (for text transport)
age -r age1recipient... -a < secret.txt # -a flag = ASCII armor
EOF
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
cat largefile.bin | gzip | age -r age1recipient... -o largefile.gz.age
# Encrypt then base64 (for text transport)
age -r age1recipient... -a < secret.txt # -a flag = ASCII armor
EOF
}
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
2. ENCRYPTED DOTFILES IN GIT
# Encrypt sensitive files before committing
age -R ~/.config/age/recipients.txt -o .env.age .env
git add .env.age
echo ".env" >> .gitignore
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
2. ENCRYPTED DOTFILES IN GIT
# Encrypt sensitive files before committing
age -R ~/.config/age/recipients.txt -o .env.age .env
git add .env.age
echo ".env" >> .gitignore
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
# Encrypt sensitive files before committing
age -R ~/.config/age/recipients.txt -o .env.age .env
git add .env.age
echo ".env" >> .gitignore
# Decrypt after cloning
age -d -i ~/.config/age/identity.txt -o .env .env.age
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
age: "age1recipient1...,age1recipient2..."
# Encrypt
sops -e secrets.yaml > secrets.enc.yaml
# Edit in place
sops secrets.enc.yaml
Without declared permissions the skill's intent is opaque and cannot be validated.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
KEY STORAGE BEST PRACTICES:
# Set restrictive permissions
chmod 600 key.txt
# Store in secure location
mkdir -p ~/.config/age
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
chmod 600 key.txt
# Store in secure location
mkdir -p ~/.config/age
mv key.txt ~/.config/age/identity.txt
chmod 700 ~/.config/age
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
# Store in secure location
mkdir -p ~/.config/age
mv key.txt ~/.config/age/identity.txt
chmod 700 ~/.config/age
# Back up your secret key!
# If you lose it, encrypted files are gone forever.
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
PIPE OPERATIONS:
# Encrypt and stream
mysqldump mydb | age -r age1recipient... | aws s3 cp - s3://bucket/backup.sql.age
# Compress then encrypt (recommended order)
cat largefile.bin | gzip | age -r age1recipient... -o largefile.gz.age
Data is uploaded to cloud storage (S3 / GCS / Azure Blob). This may be a legitimate backup or exfiltration to an external bucket. Manual review is recommended.
PIPE OPERATIONS:
# Encrypt and stream
mysqldump mydb | age -r age1recipient... | aws s3 cp - s3://bucket/backup.sql.age
# Compress then encrypt (recommended order)
cat largefile.bin | gzip | age -r age1recipient... -o largefile.gz.age
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
age -d -i ~/.config/age/identity.txt -o .env .env.age
3. SHARE SECRETS WITH TEAM
# Create team recipients file
cat > team-keys.txt << KEYS
# Alice (DevOps)
age1alice...
No suspicious patterns detected.