Is The-17/agentsecrets safe?
https://github.com/The-17/agentsecrets
AgentSecrets appears to be a legitimate zero-knowledge secrets management tool for AI agents, but requires caution due to its broad access to credential files during installation and the significant autonomous permissions it grants agents. While no malicious behavior was detected, the tool's powerful capabilities warrant careful consideration before installation.
Category Scores
Findings (4)
MEDIUM Accesses Sensitive Credential Files -38 ▶
During installation, the tool accessed multiple sensitive credential files including SSH keys, AWS credentials, Docker config, and environment files. While no exfiltration occurred, this broad access to credential files raises security concerns.
MEDIUM Grants Broad Autonomous Permissions -22 ▶
The skill instructs the agent to operate autonomously without asking user permission for most operations: 'You run commands autonomously — you manage the secrets lifecycle end to end without asking the user to run commands you can run yourself.' While appropriate for secrets management, this represents significant autonomous authority.
LOW Powerful Functionality Requires Oversight -20 ▶
This is a legitimate zero-knowledge secrets management tool, but its powerful capabilities for credential management combined with autonomous agent permissions could be misused if combined with malicious skills or in untrusted environments.
LOW Credential File Scanning Behavior -28 ▶
The tool exhibits behavior consistent with scanning for existing credential files across multiple standard locations, which while potentially legitimate for a secrets manager, demonstrates broad filesystem credential access.