secret-audit

name	secret-audit
description	Full credential security audit across local repo and VPS. Triggers: "audit secrets", "check credentials", "are my keys safe", "security check".

Secret Audit

MANDATORY: Follow all phases. Produce a traffic-light report at the end.

Phase 1: Local Repository Scan

1. Scan the kurk-org repo for files containing secret patterns:

   cd /Users/javeriaabdulsami/Projects/Content/ai60/kurk-org && \
     git ls-files | xargs grep -l -i -E '(sk-ant|ghp_|xoxb-|shpat_|Bearer [a-zA-Z0-9])'
   

   Exclude: .env.example files, documentation references, this companion project
2. Verify .gitignore covers: .env, *.pem, *.key, *_config.json, credentials.json
3. Check if gitleaks workflow exists: look for .github/workflows/*gitleaks*
4. Check no .env files are tracked: git ls-files '*.env' should return nothing

Phase 2: VPS Permissions Audit

Requires SSH. All commands are read-only (GREEN).

1. Check .env permissions:

   ssh -i ~/.ssh/id_ed25519_github root@72.62.213.231 "stat -c '%a' ~/.openclaw/.env"
   

   Must be 600. Anything else is RED.

2. Check config permissions:

   ssh -i ~/.ssh/id_ed25519_github root@72.62.213.231 "stat -c '%a' ~/.openclaw/openclaw.json"
   

   Must be 444. Anything else is YELLOW.

3. Check for world-readable credential files:

   ssh -i ~/.ssh/id_ed25519_github root@72.62.213.231 \
     "find ~/.openclaw/ -name '*.json' -perm -o+r -not -name 'openclaw.json' 2>/dev/null"
   

4. Check for .env backup copies with wrong permissions:

   ssh -i ~/.ssh/id_ed25519_github root@72.62.213.231 \
     "find ~/.openclaw/ -name '.env*' -not -name '.env' -exec stat -c '%n %a' {} \;"
   

Phase 3: Credential Freshness

1. Check if docs/CREDENTIAL-ROTATION.md exists in kurk-org
2. If it exists, read it and check each credential's last rotation date
3. Flag as:
   • CURRENT: Rotated within expected cadence
   • STALE: Past due for rotation (90+ days for API keys)
   • UNKNOWN: No rotation date recorded

Phase 4: Report

Dispatch the secret-auditor agent and present findings using its traffic-light format.

Summary rules:

• GREEN: All checks pass, all credentials current
• YELLOW: Minor issues (stale credentials, missing rotation dates, .env backups with wrong permissions)
• RED: Secrets in tracked files, wrong .env permissions, credentials in git history

Rules

• NEVER display full secret values in the report. Mask everything.
• If a RED finding exists, state it first and prominently.
• Provide exact fix commands for every finding (in plain English + the actual command).
• If .env permissions are wrong, treat as CRITICAL and provide the fix immediately: chmod 600 ~/.openclaw/.env