aegis-host-secrets
Pass
Audited by Gen Agent Trust Hub on Aug 31, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill provides a structured methodology for auditing host-level secrets, focusing on identifying incorrect permission assignments (CWE-732) and cleartext storage (CWE-312).
- [SAFE]: Implements a mandatory 'REDACTION RULE' that instructs the agent to only show truncated previews of any discovered secrets, mitigating the risk of data exposure in reports or logs.
- [SAFE]: The included bash sweep script uses standard system utilities (find, stat, grep) to collect metadata and hit counts rather than full file contents, maintaining a read-only audit posture.
- [SAFE]: Remote tools mentioned for remediation, such as 'age' and 'sops', are well-known, industry-standard utilities for encryption and secret management.
- [SAFE]: The skill explicitly distinguishes between unprivileged sweeps and those requiring root access, ensuring the agent operates within defined security boundaries.
Audit Metadata