Tracebit Canaries Skill

End-to-end security canary coverage — from signup to human-supervised incident response. You (the agent) perform setup steps yourself, with human confirmation at key decision points.

The Tracebit CLI runs a lightweight background service that refreshes canary token expiry — no other network calls or file access. When the heartbeat inbox check detects a canary alert email, you notify the human, investigate (read-only), and report.

Tracebit Community Edition is free at https://community.tracebit.com

---

Security & Transparency

This skill is user-initiated, user-supervised, and fully reversible. For full details — including file traceability, enforcement model, and removal — see references/security-compliance.md.

Skill file writes (created by agent instructions in SKILL.md, not by shell scripts):

• - /tmp/tracebit-setup-creds — temporary signup password (Step 1, chmod 600, deleted after use)
• INLINECODE2 — canary alert check block (Step 6, append)
• INLINECODE3 — incident log (playbook Phase 2.2, append-only, only on alert)

CLI writes — tracebit deploy places decoy tokens in standard credential locations, only after human confirmation. The CLI is open-source. No real credentials are read or modified.

CLI installation — SHA256-verified from official GitHub Releases only. No elevated privileges; macOS uses the standard system installer dialog.

Email — read-only search for Tracebit alerts via plugins.email.accounts. No emails sent, deleted, or modified.

Memory reads — memory/* files read during investigation only, gated on human confirmation (playbook Phase 2.4).

Background service — refreshes canary token expiry only. Runs as current user. Fully removable.

---

Execution Principles

You are the operator. The human is the owner.

• - Confirm with the human before: starting deployment, writing credentials to disk, and rotating/remediating after incidents.
• Browser steps: use the OpenClaw managed browser tool — verify availability first:

  openclaw browser --browser-profile openclaw status
  

• - Ask the human for: 2FA codes, unreadable CAPTCHAs, or missing tool configuration

---

Definition of Done

Not done until every item is checked:

CODEBLOCK1

Canaries without alert detection (Step 6) provide no protection. Do not skip it.

---

Setup Steps

Step 1: Sign Up

Use the browser tool — not any system-installed browser.

CODEBLOCK2bash
python3 -c "import secrets, string; chars = string.asciiletters + string.digits + '!@#\$%^&*'; print(''.join(secrets.choice(chars) for in range(24)))" > /tmp/tracebit-setup-creds && chmod 600 /tmp/tracebit-setup-creds
CODEBLOCK3

Error cases:

• - Email already registered: skip to Step 3
• CAPTCHA: browser screenshot, read it yourself, type it in. Ask human only if unreadable.
• Code not arriving: check spam folder, wait 20s, click "Resend code"

Step 2: Install the CLI

CODEBLOCK4

Verify: INLINECODE10

If the script fails, see references/troubleshooting.md. For manual installation, download the appropriate package from the CLI releases page:

• - Linux: download install-tracebit-linux and run INLINECODE13
• macOS arm64: download install-tracebit-osx-arm.pkg and open it — the standard macOS installer dialog will guide the user through installation
• macOS x64: download install-tracebit-osx-x64.pkg and open it — the standard macOS installer dialog will guide the user through installation

Step 3: Authenticate the CLI

INLINECODE16 starts a listener on localhost:5442 and waits for an OAuth callback.

CODEBLOCK5

Then:

1. 1. INLINECODE18
2. INLINECODE19 — find the "Authorise" button
3. Click Authorise using the ref from the snapshot
4. Callback completes automatically — log shows INLINECODE20

Verify: INLINECODE21

Fallback (if OAuth callback fails): browser navigate https://community.tracebit.com → Settings → API Keys → Create token → INLINECODE23

Step 4: Deploy All Canaries

CODEBLOCK6

The username-password credential is issued before the prompt fires. The error exit is a known CLI quirk. Just continue — tracebit show will confirm it's there.

Deploys 5 types: aws, ssh, cookie, username-password, email. See references/canary-types.md for details on each.

Step 5: Verify Deployment

CODEBLOCK7

All 5 types must appear active.

Step 6: Configure Heartbeat Alert Detection

Not optional. Without this, canaries fire silently.

Append to HEARTBEAT.md (create if needed):

CODEBLOCK8

Also add this weekly check:

CODEBLOCK9

Use a 1-hour search window to avoid missing alerts across heartbeat timing jitter.

---

Completion Report

Include verbatim when reporting to the human:

CODEBLOCK10

Password handling: After generating the password, write it to a temp file — never include it in conversation output:

echo "<generated-password>" > /tmp/tracebit-setup-creds && chmod 600 /tmp/tracebit-setup-creds

Tell the human the file path and instruct them to save the password to their password manager, then delete the file.

---

When a Canary Fires

Read and follow references/incident-response-playbook.md immediately. The playbook covers:

1. 1. Notify the human via their configured messaging channel within seconds
2. Investigate — check canary status and log the incident (one append-only write to memory/security-incidents.md); reading memory files requires human confirmation
3. Report findings to the human within 5 minutes
4. Rotate canaries only after human acknowledgement: INLINECODE29

Removal

To fully remove all Tracebit components, see references/security-compliance.md — includes a cleanup script and manual removal steps.

---

Gotchas

• - tracebit deploy all does not include the email canary — always run tracebit deploy email separately
• The username-password canary prompts "Have you saved this in your password manager? [y/n]" which fails non-interactively. The credential is issued before the prompt — check tracebit show. If missing: INLINECODE34
• Email canary tracking pixel: opening/previewing the canary email fires the alert. This is by design — the email is the bait.
• Canary credentials are fake — never use them for real workloads
• CLI token stored at the standard Tracebit config location — do not expose in logs or shared contexts
• Do not log canary credential values — they become attack vectors if exposed

---

Reference Files

File	When to Read
INLINECODE35	When a canary fires — full IR procedure
INLINECODE36

Understanding each canary type and placement | | references/attack-patterns.md | Real-world attacks canaries detect | | references/security-compliance.md | Safety posture, credential handling, messaging rules, full removal | | references/api-reference.md | Only if CLI unavailable — API fallback | | references/troubleshooting.md | When something isn't working |