/secrets-audit

allowed-tools: Task, Bash(rg:*), Bash(fd:*), Bash(bat:*), Bash(jq:*), Bash(gdate:*), Bash(git:*), Bash(eza:*), Bash(wc:*), Bash(head:*), Bash(tail:*)
name: "Secrets Audit"
description: "Comprehensive security audit for leaked credentials with parallel analysis and state management"
author: "wcygan"
tags: ["security","audit"]
version: "1.0.0"
created_at: "2025-07-14T00:00:00Z"
updated_at: "2025-07-14T00:00:00Z"

Context

• Session ID: !`gdate +%s%N 2>/dev/null || date +%s%N 2>/dev/null || echo "$(date +%s)$(jot -r 1 100000 999999 2>/dev/null || shuf -i 100000-999999 -n 1 2>/dev/null || echo $RANDOM$RANDOM)"`
• Scan scope: $ARGUMENTS (default: comprehensive scan)
• Current directory: !`pwd`
• Git repository status: !`git status --porcelain 2>/dev/null | wc -l | tr -d ' '` modified files
• Project type detection: !`fd "(package\.json|Cargo\.toml|go\.mod|deno\.json|pom\.xml|build\.gradle|requirements\.txt)" . -d 2 | head -3 || echo "No build files detected"`
• Codebase size: !`fd "\.(js|ts|jsx|tsx|rs|go|java|py|rb|php|c|cpp|h|hpp|cs|kt|swift|scala|env|json|yaml|yml|toml)" . | wc -l | tr -d ' '` files
• Ignore patterns: !`test -f .gitignore && echo "✓ .gitignore found" || echo "⚠️ No .gitignore found"`
• Modern tools status: !`echo "rg: $(which rg >/dev/null && echo ✓ || echo ✗) | fd: $(which fd >/dev/null && echo ✓ || echo ✗) | bat: $(which bat >/dev/null && echo ✓ || echo ✗) | jq: $(which jq >/dev/null && echo ✓ || echo ✗)"`

Your task

STEP 1: Initialize comprehensive security audit session with state management

TRY:

• CREATE session state file: `/tmp/secrets-audit-$SESSION_ID.json`
• VALIDATE modern CLI tools availability (rg, fd, bat, jq are MANDATORY)
• ANALYZE project context and determine scanning strategy
• ESTABLISH security baseline for comparison

# Initialize audit session state
echo '{
  "sessionId": "'$SESSION_ID'",
  "scanScope": "'$ARGUMENTS'",
  "projectType": "auto-detect",
  "startTime": "'$(gdate -Iseconds 2>/dev/null || date -Iseconds)'",
  "findings": [],
  "scannedFiles": 0,
  "riskLevel": "unknown",
  "recommendations": []
}' > /tmp/secrets-audit-$SESSION_ID.json

STEP 2: Adaptive scanning strategy selection with intelligent routing

CASE scan_scope: WHEN "staged":

• EXECUTE targeted Git staged changes scan
• FOCUS on files ready for commit
• PREVENT secrets from entering repository

WHEN "recent":

• EXECUTE Git history analysis (last 30 days)
• SCAN recent commits for accidentally committed secrets
• IDENTIFY patterns in recent development

WHEN "comprehensive" OR empty:

• LAUNCH parallel sub-agents for thorough analysis
• COORDINATE comprehensive security audit
• GENERATE detailed security report

WHEN specific_patterns:

• EXECUTE targeted scan for user-specified patterns
• APPLY custom detection rules
• PROVIDE focused analysis results

**Quick Staged Changes Scan:**

# Git staged changes security scan
git diff --staged --name-only | xargs rg -i "(password|secret|key|token|credential|api_key)" --context 2 --color always

echo "🔍 Scanning staged changes for secrets..."
git diff --staged | rg -i "(password|secret|key|token|credential)" --context 2 --color always || echo "✅ No obvious secrets found in staged changes"

STEP 3: Parallel comprehensive security audit using sub-agent architecture

IF codebase_size > 500 files OR scan_scope contains "comprehensive":

LAUNCH parallel sub-agents for systematic security analysis:

• **Agent 1: Credentials & API Keys Scanner**: Search for API keys, tokens, and authentication credentials
• Focus: AWS keys, GitHub tokens, API keys, OAuth secrets, JWT tokens
• Tools: rg with credential-specific patterns, entropy analysis
• Output: High-risk credential findings with immediate rotation recommendations

• **Agent 2: Database Security Scanner**: Analyze database connection strings and credentials
• Focus: Connection strings, database passwords, MongoDB URIs, Redis credentials
• Tools: rg with database-specific patterns, connection string analysis
• Output: Database security vulnerabilities and access control findings

• **Agent 3: Private Key & Certificate Scanner**: Search for cryptographic materials and certificates
• Focus: Private keys, certificates, SSH keys, PGP keys, SSL certificates
• Tools: rg with crypto patterns, fd for certificate files, key format detection
• Output: Cryptographic material exposure analysis

• **Agent 4: Configuration Security Scanner**: Audit configuration files and environment variables
• Focus: .env files, config files, Docker secrets, Kubernetes secrets
• Tools: fd for config files, rg for environment patterns, structured data analysis
• Output: Configuration security assessment and hardening recommendations

• **Agent 5: Code & Comment Security Scanner**: Analyze source code and comments for sensitive information
• Focus: Hardcoded secrets, TODO comments with credentials, debug information
• Tools: rg with code-specific patterns, comment analysis, debug string detection
• Output: Source code security findings and clean coding recommendations

**Sub-Agent Coordination:**

# Each agent reports findings to session state
echo "🚀 Launching parallel security analysis agents..."
echo "🔍 Comprehensive audit covers: credentials, databases, keys, configs, code"
echo "📊 Results will be aggregated and prioritized by risk level"

STEP 4: Execute targeted security pattern detection with modern tooling

**Core Security Pattern Detection:**

# High-priority credential patterns with risk classification
echo "🔍 Executing comprehensive pattern detection..."

# API Keys & Tokens (CRITICAL RISK)
rg -i "api[-_]?key\s*[:=]\s*['\"]?[a-zA-Z0-9]{20,}['\"]?" \
  --type-add 'config:*.{env,json,yaml,yml,toml,ini,conf}' \
  --type config --type js --type ts --type python --type go --type rust \
  --context 2 --color always

# Cloud Provider Keys (CRITICAL RISK)
rg -i "(aws_access_key|aws_secret|azure_client|gcp_service_account|AKIA[