Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add Agnuxo1/EnigmAgent --skill clawhubgit clone --depth 1 https://github.com/Agnuxo1/EnigmAgentWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/agnuxo1/enigmagent/clawhub)<a href="https://agentmods.dev/skills/agnuxo1/enigmagent/clawhub"><img src="https://agentmods.dev/badge/skills/agnuxo1/enigmagent/clawhub/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/agnuxo1/enigmagent/clawhub"><img src="https://agentmods.dev/badge/skills/agnuxo1/enigmagent/clawhub.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00000 | $0.00782 |
| Opus 5 | $0.00000 | $0.00391 |
| Sonnet 5 | $0.00000 | $0.00156 |
| Haiku 4.5 | $0.00000 | $0.00078 |
Grade A, and why
clawhub scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
Input: "curl -H 'Authorization: Bearer {{OPENAI_API_KEY}}' https://api.openai.com/v1/models" How it starts
The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.
enigmagent-vault
Category: Security / Credentials
Type: skill
Version: 1.0.0
Author: EnigmAgent
License: MIT
Homepage: https://enigmagent.com
Overview
enigmagent-vault is a ClawHub skill that gives your agents secure, local-vault access to API keys, tokens, passwords, and private documents — without ever hardcoding credentials.
Agents reference secrets as {{PLACEHOLDER}} symbols. The vault resolves them at execution time using AES-256-GCM encryption, never exposing values in prompts, logs, or memory.
What this skill does
- Check vault status — verify the EnigmAgent server is running and unlocked before starting any credentialed task
- List secrets — discover what secrets are available (names and domains, never values)
- Resolve placeholders — replace
{{SECRET_NAME}}with the real value at call time - Guard agent memory — integrate with Mem0 / vector stores to keep placeholders symbolic in stored memories
Tools provided
| Tool | Description |
|---|---|
enigmagent_vault_status |
Check if vault is running and unlocked |
enigmagent_vault_list |
List all secret names and domains |
enigmagent_resolve |
Resolve a single {{PLACEHOLDER}} |
enigmagent_resolve_text |
Replace all {{PLACEHOLDER}} in a text block |
Installation
# Via ClawHub CLI
clawhub install enigmagent-vault
# Manual (npm)
npm install clawhub-skill-enigmagent
After installing, add to your agent config:
skills:
- enigmagent-vault
Configuration
| Key | Default | Description |
|---|---|---|
enigmagent.host |
127.0.0.1 |
Vault server host |
enigmagent.port |
3737 |
Vault server port |
enigmagent.origin |
http://localhost |
Origin for domain binding |
# .clawhub/config.yaml
enigmagent:
host: 127.0.0.1
port: 3737
origin: http://localhost
Security model
- The vault server runs locally only —
127.0.0.1, never exposed to the network - Credentials are encrypted with AES-256-GCM + Argon2id KDF
- Domain binding ensures a secret can only be accessed from its registered origin
- Placeholder references are symbolic in all agent prompts and memory stores
What ships with it
3 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 9d ago First seen · 112 lines · 0 tokens per session scan A 9c614fe07559
clawhub is a skill published in the GitHub repository Agnuxo1/EnigmAgent (4 stars, last pushed 3mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 782 tokens. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
legacy-shield
Secure zero-knowledge document vault for AI agents. Persistence for your secrets.
secret-vault
Encrypted credential store — AES-256-GCM secured tokens and secrets in one place.
opik-diagnose
Surface the Opik traces worth a developer's attention, ranked by signal — Diagnostics issues first, then errors, failed tool calls, latency, regressions, and low online-eval scores. With the Opik MCP connected it lists the project's agentinsightsissue entities, then fills the gaps with list (filters, sort, a time…
cis-aws-foundations-3.3.1
Ensure that encryption is enabled for EFS file systems.
client-scripts
Write ServiceNow client scripts (onLoad/onChange/onSubmit/onCellEdit) using gform, guser, GlideAjax, field visibility/mandatory toggles, and validation with debounced server calls.
agreement-setup
Set up a bKash tokenized agreement for repeat charges and check its status.