security-audit

Scan Zo Computer workspaces for plaintext secrets and insecure file permissions.

Updated Mar 25, 2026

Search Tags:#security #audit #permissions #secrets #env-vars #hardening #code-scan

Ready to run

npx skills add https://github.com/Batsirai/adoro-studios --skill security-audit-batsirai

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: security-audit
Source: https://github.com/Batsirai/adoro-studios/tree/main/Skills/security-audit
Command: npx skills add https://github.com/Batsirai/adoro-studios --skill security-audit-batsirai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This Skill identifies and mitigates security risks in Zo Computer workspaces by scanning for plaintext secrets, insecure file permissions, dangerous agent patterns, and missing environment-based credentials.

Core Features & Use Cases

Secrets discovery: Detects plaintext API keys, tokens, and credentials in code, config, and documents.
Permission hardening: Flags world-readable file permissions in AGENTS.md, SOUL.md, and key config files.
Agent hardening & integration checks: Reviews program files for dangerous shell patterns and enforces environment-based secret usage.
Use Case: After installing a new skill or integration, run the audit to proactively find and remediate exposure before deployment.

Quick Start

Run the security audit to scan for plaintext secrets, insecure permissions, and integration gaps.

Frequently Asked Questions about security-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan my workspace for plaintext secrets and hardcoded API keys?▼

Scanning for plaintext secrets detects hardcoded patterns like sk_live_, AIza, and Bearer tokens across project code and configuration files, ensuring credentials are loaded from a secure environment manager instead.

What is the best way to harden file permissions in my development workspace?▼

Permission hardening flags world-readable file permissions in critical configuration files like AGENTS.md and SOUL.md, identifying access risks to prevent unauthorized reads of sensitive workspace data.

Does this security audit check for dangerous agent patterns in program files?▼

Yes, the security audit reviews program files for dangerous shell patterns and enforces environment-based secret usage, proactively finding and remediating agent-based workflow exposure before deployment.

How do I find missing environment-based credentials in my configuration files?▼

Finding missing environment-based credentials involves scanning configuration files and skill integrations to ensure secrets are loaded from the secret manager rather than being hardcoded in the environment variables.

Can I run a security audit after installing a new skill or integration?▼

Yes, running a security audit after installing a new skill or integration proactively scans project code and configuration files to detect secrets, access risks, and hardening gaps before deployment.

What types of tokens and API keys are detected during a code scan?▼

A code scan detects specific plaintext API keys and tokens by enforcing patterns such as sk_live_, sk_test_, AIza, and Bearer tokens across project code, config files, and documents.