heldkeys

heldkeys is a robust security tool designed to help developers identify the credentials that might be accessible to AI agents running on their machines, within sandboxes, or during Continuous Integration (CI) workflows. By providing a comprehensive inventory of potentially sensitive information, heldkeys enables users to safeguard their systems against the risks of prompt injection attacks and unauthorized access.

Key Features

• Credential Discovery: Lists the credentials that are accessible to the AI agent including environment variables, cloud CLI logins (like AWS, Azure), AI tool logins (Codex, Claude Code, etc.), developer platform logins (Vault, Terraform, Vercel, and more), package and Git tokens, SSH keys, .env files, and editor history copies.

• Risk Assessment in GitHub Actions: Analyzes AI agent steps within GitHub Actions workflows, identifying triggers that could be exploited, potential write tokens, and ensuring that sensitive agents are not running under insecure conditions.

• Minimal Footprint: Operates as a single self-contained binary for both Linux and macOS, executing tasks read-only and without telemetry, providing results in a matter of seconds without ever exposing sensitive data.

Usage Example

To utilize heldkeys, execute the following command in the terminal to scan for reachable credentials:

heldkeys

This command will output a summary similar to the one below, providing a clear view of sensitive data that needs addressing:

heldkeys: 13 credentials reachable from ~/code/app (7 long-lived with write access)

Fix these first
  HIGH    GitHub personal access token  env: GITHUB_TOKEN  ghp_…021  ×2
...

What heldkeys Does Not Do

• No Secrets Exposure: It never prints the actual secrets; it represents them as fingerprints (e.g., AKIA…PLA) for formats that allow public prefixes.
• Data Privacy: No data is sent externally; there is absolutely no telemetry or data collection.
• Non-intrusive Operations: It does not write to the machine or modify files unless explicitly instructed. Only output files designated by the user are created.

CI and Sandbox Integration

Integrating heldkeys into CI pipelines can help detect vulnerabilities stemming from misconfigured workflows, ensuring that AI agents do not operate with harmful access rights. By using commands like heldkeys ci, users can evaluate their workflows in real-time and receive actionable insights for enhancement.

Conclusion

By employing heldkeys, developers can proactively mitigate the risks associated with credential exposure in workflows involving AI agents. This tool is invaluable for maintaining the integrity of code security while leveraging AI technologies effectively.