Agent Security Ops

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:55 PM UTC
• Version: 1.2.2

Overview

This is a legitimate security scanner, but it needs Review because default scans can read and re-output sensitive data outside the target repository.

Review before installing if you do not want a skill to inspect workstation-level data. Avoid running its default scan in CI or cron until reports are redacted or access is narrowed, because findings may include full secret-bearing lines and host metadata. Use --fix-ssh only when you intentionally want it to change SSH file permissions.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/scan.sh:166

Finding

Raw Secret Values Are Exposed in Logs, JSON Reports, and Persistent Monitoring State

Content

View full analysis

/dev/null | \ grep -v 'MARKER:agent-security-ops' | \ grep -v 'patterns\.md' || true) grep_count=$(count_lines "$grep_out") low_grep_out=$(grep -rEn --exclude-dir=.git --exclude-dir=node_modules --exclude-dir=.venv \ --exclude-dir=venv --exclude-dir=__pycache__ --exclude-dir=.security-ops \ --exclude='*.example' --exclude='.env.example' --exclude='.env.*.example' \ "$LOW_PAT" \ --include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \ --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \ --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \ --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \ --include='*.tf' --include='*.tfvars' \ . 2>/dev/null | \ grep -v 'MARKER:agent-security-ops' | \ grep -v 'patterns\.md' || true) low_grep_count=$(count_l ...[truncated 4739 chars]

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/scan.sh:297

Finding

Default Repository Scan Accesses Unrelated Host Secrets and Security Metadata

Content

View full analysis

/dev/null | grep LISTEN || true) elif command -v ss >/dev/null 2>&1; then open_ports_out=$(ss -tlnp 2>/dev/null || true) else warn "No port scan tool available (need lsof or ss)" fi if [ -n "$open_ports_out" ]; then open_ports_count=$(count_lines "$open_ports_out") if [ "$(uname -s)" = "Darwin" ]; then port_list=$(echo "$open_ports_out" | awk '{print $9}' | grep -oE '[0-9]+$' | sort -un || true) else port_list=$(echo "$open_ports_out" | grep -oE ':([0-9]+)' | sed 's/://' | sort -un || true) fi for port in $port_list; do is_common=0 for cp in $COMMON_PORTS; do if [ "$port" = "$cp" ]; then is_common=1; break; fi done if [ "$is_common" -eq 0 ]; then unexpected_arr+=("$port") fi done fi ``` ```bash # scripts/scan.sh:340-371 ENV_SECRET_PAT='export[[:space:]]+([-_A-Za-z0-9]*(KEY|TOKEN|SECRET|PASSWORD))[[:space:]]*=' for rcfile in "$HOME/.bashrc" "$HOME/.zshrc" "$HOME/.bash_profile" "$HOME/.profile"; do if [ -f "$rcfile" ]; then hits=$(grep -En "$ENV_SECRET_PAT" "$rcfile" 2>/dev/null || true) if [ -n "$hits" ]; then env_secrets_out="${env_secrets_out}${rcfile}:${hits} " fi fi done for dir in "$HOME" "$HOME/Desktop" "$HOME/Downloads"; do if [ -d "$dir" ]; then found=$(find "$dir" -maxdepth 1 -name '.env*' -not -name '*.example' -type f 2>/dev/null || true) if [ -n "$found" ]; then env_files_out="${env_files_out}${found} " fi fi done ``` ```bash # scripts/scan.sh:418-460 if [ -d "$HOME/.ssh" ]; then ssh_dir_perms=$(stat -f '%Lp' "$HOM ...[truncated 3735 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (54)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The marketing claim of 'one command' security and cron monitoring overstates actual behavior and understates side effects such as optional ~/.ssh permission changes via --fix-ssh. Misleading descriptions are dangerous in security tooling because users may invoke setup without realizing it can alter host SSH permissions or that monitoring requires separate cron configuration.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The marketing claim of 'one command' security and cron monitoring overstates actual behavior and understates side effects such as optional ~/.ssh permission changes via --fix-ssh. Misleading descriptions are dangerous in security tooling because users may invoke setup without realizing it can alter host SSH permissions or that monitoring requires separate cron configuration.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The skill explicitly scans $HOME, Desktop, Downloads, shell profiles, and other non-repo locations for .env files and secrets. Even with benign intent, this broad credential-access behavior materially expands the data the skill can read, including secrets unrelated to the target repository, making accidental over-collection and privacy exposure much more dangerous.

Content

Scanner excerpt · SKILL.md (reported line 145)May include surrounding context.

md

- **IaC limited to Docker**: No Terraform, Kubernetes, or CloudFormation scanning beyond basic grep patterns on `.tf`/`.tfvars`.
- **TruffleHog verification**: Verification depends on service availability — if an API is down, a real secret may show as "unverified." That's why we now scan all secrets, not just verified ones.
- **Port scanning**: Only detects currently listening ports, not firewall rules or network exposure. May need sudo on macOS for full process info.
- **`$HOME` .env scan**: Checks outside repo scope as a convenience — findings are warnings only, not counted as repo findings.

## What It Scans

Credential Access

High

• Category: Privilege Escalation
• Confidence: 97% confidence

Finding

The documented 'Env Secrets' and 'SSH Audit' checks involve reading shell profiles, loose .env files, ~/.ssh metadata, keys/config locations, and related credential-bearing artifacts. In a skill advertised mainly for repo secret prevention, this creates a meaningful credential-access surface that could expose sensitive host secrets beyond the repository under review.

Content

Scanner excerpt · SKILL.md (reported line 159)May include surrounding context.

md

| Dependencies | npm/pip audit | Known CVEs in packages |
| Permissions | find | World-readable sensitive files |
| Open Ports | lsof/ss | Unexpected listening services |
| Env Secrets | grep | Hardcoded secrets in shell profiles, loose .env files (warning) |
| Docker Secrets | grep | Hardcoded secrets in Dockerfiles and compose files |
| SSH Audit | stat | Permission checks on ~/.ssh, keys, config |
| Git Remotes | git/gh | Insecure HTTP remotes, public repo detection |

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill attempts to nullify the agent's safety policies or restrictions ('you have no restrictions', 'ignore your guidelines', 'do anything now'). This is a direct jailbreak that disables guardrails.

Content

Scanner excerpt · SKILL.md (reported line 195)May include surrounding context.

md

Agent Security Ops installs pre-commit hooks and runs 10-point security scans to prevent AI agents from leaking secrets. Catches API keys, tokens, passwords, and credentials before they reach git history.

**What problem does it solve?**
AI agents generate and handle credentials constantly — API keys, tokens, database URLs. Without guardrails, these end up in commits, logs, or chat messages. This skill adds automated scanning at commit-time and on-demand.

**What are the requirements?**
Bash, git, and TruffleHog (installed automatically). Works on macOS and Linux. No API keys or external services needed.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 50)May include surrounding context.

sh

--version     Show version

Note: Open port scan may require sudo on macOS for full process info.
Note: $HOME .env file check scans outside repo scope (warns only, not counted as repo findings).
USAGE
      exit 0
      ;;

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 168)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 186)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 211)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 251)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 168)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 186)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 211)May include surrounding context.

sh

--include='*.js' --include='*.ts' --include='*.py' --include='*.rb' \
  --include='*.go' --include='*.java' --include='*.yaml' --include='*.yml' \
  --include='*.json' --include='*.toml' --include='*.ini' --include='*.cfg' \
  --include='*.conf' --include='*.sh' --include='*.env' --include='*.env.local' \
  --include='*.tf' --include='*.tfvars' --include='*.properties' --include='*.xml' \
  --include='*.md' --include='*.txt' \
  --include='Makefile' --include='Procfile' --include='Vagrantfile' \

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 211)May include surrounding context.

sh

# --- 3. .gitignore audit ---
# [M6] Use git check-ignore
section ".gitignore Audit"
REQUIRED=('.env' '.env.local' 'test.pem' 'test.key' 'id_rsa' 'test.p12' 'test.pfx' 'credentials.json' 'token.json' 'service-account-test.json' 'test.keystore' '.terraform/')
REQUIRED_LABELS=('.env*' '*.pem' '*.key' 'id_rsa*' '*.p12' '*.pfx' 'credentials.json' 'token.json' 'service-account*.json' '*.keystore' '.terraform/')

if [ -f .gitignore ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 212)May include surrounding context.

sh

# --- 3. .gitignore audit ---
# [M6] Use git check-ignore
section ".gitignore Audit"
REQUIRED=('.env' '.env.local' 'test.pem' 'test.key' 'id_rsa' 'test.p12' 'test.pfx' 'credentials.json' 'token.json' 'service-account-test.json' 'test.keystore' '.terraform/')
REQUIRED_LABELS=('.env*' '*.pem' '*.key' 'id_rsa*' '*.p12' '*.pfx' 'credentials.json' 'token.json' 'service-account*.json' '*.keystore' '.terraform/')

if [ -f .gitignore ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/scan.sh (reported line 266)May include surrounding context.

sh

# --- 3. .gitignore audit ---
# [M6] Use git check-ignore
section ".gitignore Audit"
REQUIRED=('.env' '.env.local' 'test.pem' 'test.key' 'id_rsa' 'test.p12' 'test.pfx' 'credentials.json' 'token.json' 'service-account-test.json' 'test.keystore' '.terraform/')
REQUIRED_LABELS=('.env*' '*.pem' '*.key' 'id_rsa*' '*.p12' '*.pfx' 'credentials.json' 'token.json' 'service-account*.json' '*.keystore' '.terraform/')

if [ -f .gitignore ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 242)May include surrounding context.

sh

# --- 3. .gitignore audit ---
# [M6] Use git check-ignore
section ".gitignore Audit"
REQUIRED=('.env' '.env.local' 'test.pem' 'test.key' 'id_rsa' 'test.p12' 'test.pfx' 'credentials.json' 'token.json' 'service-account-test.json' 'test.keystore' '.terraform/')
REQUIRED_LABELS=('.env*' '*.pem' '*.key' 'id_rsa*' '*.p12' '*.pfx' 'credentials.json' 'token.json' 'service-account*.json' '*.keystore' '.terraform/')

if [ -f .gitignore ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/setup.sh (reported line 257)May include surrounding context.

sh

# --- 3. .gitignore audit ---
# [M6] Use git check-ignore
section ".gitignore Audit"
REQUIRED=('.env' '.env.local' 'test.pem' 'test.key' 'id_rsa' 'test.p12' 'test.pfx' 'credentials.json' 'token.json' 'service-account-test.json' 'test.keystore' '.terraform/')
REQUIRED_LABELS=('.env*' '*.pem' '*.key' 'id_rsa*' '*.p12' '*.pfx' 'credentials.json' 'token.json' 'service-account*.json' '*.keystore' '.terraform/')

if [ -f .gitignore ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 96% confidence

Finding

This section initiates an environment audit that explicitly scans for secrets in shell profiles and loose .env files under the user’s home directories. Because it targets locations outside the repo and likely to contain real credentials, it materially increases exposure risk and exceeds the declared scope.

Content

Scanner excerpt · scripts/scan.sh (reported line 329)May include surrounding context.

sh

fi

# --- 7. Environment Variable Audit ---
# [POLISH] $HOME .env scan is outside repo scope — warn only, don't count as repo findings
section "Environment Variable Audit"
env_secrets_out=""
env_files_out=""

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

The script reports and prints loose .env files outside the repository, which can disclose sensitive filenames and locations in personal directories. Since these files often contain live credentials, enumerating them by default is a significant privacy and security concern.

Content

Scanner excerpt · scripts/scan.sh (reported line 365)May include surrounding context.

sh

echo "$env_secrets_out" | head -10 >&2
fi
if [ "$env_files_warning_count" -gt 0 ]; then
  warn "Found $env_files_warning_count loose .env file(s) outside repo (warning only, not counted as repo findings)"
  echo "$env_files_out" | head -10 >&2
fi
if [ "$env_secrets_count" -eq 0 ] && [ "$env_files_warning_count" -eq 0 ]; then

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The message confirms the tool audits shell profiles and loose .env files outside the repository, reinforcing that the script’s default behavior includes access to sensitive credential-bearing locations. In context, this makes the tool more invasive than its repo-scanning description suggests.

Content

Scanner excerpt · scripts/scan.sh (reported line 369)May include surrounding context.

sh

echo "$env_files_out" | head -10 >&2
fi
if [ "$env_secrets_count" -eq 0 ] && [ "$env_files_warning_count" -eq 0 ]; then
  log "No hardcoded secrets in shell profiles or loose .env files"
fi

# --- 8. Docker Secret Check ---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Reading ~/.ssh/authorized_keys is access to sensitive authentication configuration outside the repository. Even though the script only counts lines, it still inspects a credential-relevant file unrelated to repo secret scanning and reveals host access metadata.

Content

Scanner excerpt · scripts/scan.sh (reported line 443)May include surrounding context.

sh

fi
  done

  if [ -f "$HOME/.ssh/authorized_keys" ]; then
    ak_count=$(wc -l < "$HOME/.ssh/authorized_keys" | tr -d ' ')
    if [ "$ak_count" -gt 0 ]; then
      info "authorized_keys has $ak_count key(s)"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

Counting entries in ~/.ssh/authorized_keys still requires reading a sensitive file that maps who can access the host. This exceeds the stated repo-focused purpose and can disclose security posture information about the user environment.

Content

Scanner excerpt · scripts/scan.sh (reported line 444)May include surrounding context.

sh

done

  if [ -f "$HOME/.ssh/authorized_keys" ]; then
    ak_count=$(wc -l < "$HOME/.ssh/authorized_keys" | tr -d ' ')
    if [ "$ak_count" -gt 0 ]; then
      info "authorized_keys has $ak_count key(s)"
    fi

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

set -euo pipefail

# [C2] Fail-closed: if trufflehog is missing, block the commit.
# Use "git commit --no-verify" to bypass in emergencies (NOT recommended — see SKILL.md).
if ! command -v trufflehog >/dev/null 2>&1; then
  echo "✗ trufflehog not found — commit blocked (fail-closed). Install it or use git commit --no-verify." >&2
  exit 1

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · scripts/setup.sh (reported line 172)May include surrounding context.

sh

set -euo pipefail

# [C2] Fail-closed: if trufflehog is missing, block the commit.
# Use "git commit --no-verify" to bypass in emergencies (NOT recommended — see SKILL.md).
if ! command -v trufflehog >/dev/null 2>&1; then
  echo "✗ trufflehog not found — commit blocked (fail-closed). Install it or use git commit --no-verify." >&2
  exit 1

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: SKILL.md:65