skills.rest
Lingtai-AI
Lingtai-AIOFFICIAL
Explore all skills by this author →
GitHub

dev-guide-security-audit

Audit LingTai network directories for leaked secrets, loose permissions, and misconfigured agents.

692|60|Updated Mar 15, 2026
Search Tags:#file permissions#least privilege#secret scanning#mcp configuration#credential leak#lingtai#Security audit
One-click install
npx skills add https://github.com/Lingtai-AI/lingtai --skill dev-guide-security-audit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: dev-guide-security-audit
Source: https://github.com/Lingtai-AI/lingtai/tree/main/tui/internal/preset/skills/lingtai-dev-guide/reference/security-audit
Command: npx skills add https://github.com/Lingtai-AI/lingtai --skill dev-guide-security-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

LingTai agent networks accumulate secrets, configs, mail, and data files on the local filesystem, and misconfigurations like hardcoded API keys or over-privileged agents can go unnoticed. This Skill provides a read-only, six-dimension audit framework that scans a network directory and produces a severity-classified report without ever modifying files or exposing secret values.

Core Features & Use Cases

  • Secret Leak Scanning: Greps for known credential patterns (GitHub PATs, OpenAI keys, AWS keys, JWTs, private keys) and persists a path-only triage report with values redacted.
  • Permission and Config Audits: Checks file permissions on .secrets/ and .env files, validates MCP servers.json for hardcoded keys versus environment variable references, and reviews init.json for excessive karma/nirvana admin privileges.
  • Communication and Data Exposure Review: Flags sensitive content in plaintext pigeon mailboxes, large data dumps, codex export files, and secrets committed to git history.
  • Use Case: Before sharing a LingTai network directory with collaborators, run the full audit to confirm no API keys are hardcoded in MCP configs and that only orchestrator agents hold karma or nirvana privileges.

Quick Start

Run a full security audit of my LingTai network directory and report any leaked secrets, permission issues, or over-privileged agents with severity ratings.

Frequently Asked Questions about dev-guide-security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a directory for leaked API keys and secrets?▼

Run grep with known credential patterns such as ghp_ for GitHub PATs, sk- for OpenAI keys, and AKIA for AWS keys against the target directory. Persist only matching file paths to a report and never include the actual secret values.

How do I audit MCP server configuration for hardcoded secrets?▼

Check each servers.json file for inline api_key, secret, or token values instead of ${ENV_VAR} references. Also verify that command fields point to trusted system paths rather than /tmp/ or downloaded scripts.

What file permissions should .secrets/ files have?▼

Files under .secrets/ should be mode 600 or 400 so only the owning user can read them. The audit flags any .secrets/*.json file with looser permissions as a finding.

Can this audit fix the security issues it finds?▼

No, the framework is strictly read-only by design. It scans, classifies severity, and recommends remediation, but all fixes must be performed manually by authorized personnel.

What are karma and nirvana permissions in LingTai agents?▼

Karma lets an agent suspend or interrupt peer processes, while nirvana lets it permanently delete agents and their working directories. Only orchestrators should hold karma, and nirvana should be restricted to the primary orchestrator.

Related Skills

Explore More Software Engineering Skills→
Lingtai-AILingtai-AI
621

tutorial-guide

Guide learners through a 12-lesson tutorial on Lingtai with live exploration.

Official
Advanced
Lingtai-AILingtai-AI
621

lingtai-issue-report

File structured LingTai issue reports via GitHub CLI or manual submission.

Official
Advanced
githubgithub
38.5k

mcp-security-audit

Audit MCP server configurations for hardcoded secrets, shell injection, and unpinned dependencies.

Official
Intermediate
balsm-healthbalsm-health
2

implementing-secrets-scanning-in-ci-cd

Automate hardcoded secret detection in CI/CD pipelines with gitleaks and trufflehog.

Official
Advanced