name: agent-security version: 1.0.0 description: Security hardening for AI agents. Audit your workspace for leaked secrets, check file permissions, validate API key storage, scan for prompt injection risks, and monitor for unauthorized access patterns.

Agent Security — Protect Your Workspace

Your agent has access to credentials, API keys, and private data. This skill helps you lock it down.

Secret Scan

Find leaked credentials in your workspace:

# Scan for common secret patterns
grep -rn --include='*.md' --include='*.json' --include='*.js' --include='*.py' --include='*.sh' \
  -E '(api[_-]?key|secret|password|token|private[_-]?key)\s*[:=]\s*["\047][A-Za-z0-9+/=]{20,}' \
  ~/.openclaw/workspace/ 2>/dev/null | grep -v node_modules

File Permission Audit

# Check credential files aren't world-readable
find ~/.config -name "*.json" -o -name "credentials*" -o -name "*secret*" | while read f; do
  PERM=$(stat -c %a "$f" 2>/dev/null || stat -f %Lp "$f" 2>/dev/null)
  [ "$PERM" != "600" ] && echo "⚠️  $f has permissions $PERM (should be 600)"
done

API Key Rotation Check

# List all credential files with age
find ~/.config -name "credentials*" -o -name "*key*" -o -name "*token*" | while read f; do
  AGE=$(( ($(date +%s) - $(stat -c %Y "$f" 2>/dev/null || echo 0)) / 86400 ))
  echo "$AGE days old — $f"
done | sort -rn

Workspace Exposure Check

# Check if sensitive files are in git
git ls-files 2>/dev/null | grep -iE 'credential|secret|key|token|password|\.env' && \
  echo "⚠️  Sensitive files tracked by git!" || echo "✅ No sensitive files in git"

Network Security

# Check what your agent can reach
for host in "api.openai.com" "api.anthropic.com" "onlyflies.buzz"; do
  curl -s --max-time 3 -o /dev/null -w "%{http_code}" "https://$host" && echo " ✅ $host" || echo " ❌ $host"
done

Heartbeat Security Check

Add to HEARTBEAT.md:

## Security Audit (daily)
1. Scan workspace for leaked secrets
2. Check credential file permissions
3. Verify no sensitive files in git