Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/albemiglio/keyward/using-keywardnpx skills add albemiglio/keyward --skill using-keywardgit clone --depth 1 https://github.com/albemiglio/keywardWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00068 | $0.00915 |
| Opus 5 | $0.00034 | $0.00458 |
| Sonnet 5 | $0.00014 | $0.00183 |
| Haiku 4.5 | $0.00007 | $0.00092 |
Grade C, and why
using-keyward scanned grade C with 3 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
with chmod 600 permissions. When the user's prompt references one of these Reads agent configuration directoriesmediumAgent snooping
.claude/, .codex/, .gemini/ hold keys, settings and other credentials a mod has no legitimate need for.
transcript. If you `cat ~/.claude/secrets/openai.txt`, the value is now in the Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
export OPENAI_API_KEY=$(cat ~/.claude/secrets/openai.txt) && curl https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY" How it starts
The opening of the file, as written. The whole thing — 92 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Using Keyward secrets safely
The Keyward plugin saves intercepted API keys to ~/.claude/secrets/<name>.txt
with chmod 600 permissions. When the user's prompt references one of these
files — directly or via a <<secret:NAME stored at ~/.claude/secrets/NAME.txt>>
reference — you must read and use the value WITHOUT printing it.
The rule
Never cat a secret file as a top-level command, never echo its contents,
never paste its value into your reply, never write it into a file the user can
read alongside their code.
The contents of bash stdout are added to your context window and persist in the
transcript. If you cat ~/.claude/secrets/openai.txt, the value is now in the
conversation — defeating the entire purpose of the vault.
The pattern
Always inline-expand the secret as a shell variable in the same command that uses it. The value flows from disk → process env → tool, never appearing in your stdout.
✅ Correct
export OPENAI_API_KEY=$(cat ~/.claude/secrets/openai.txt) && curl https://api.openai.com/v1/models -H "Authorization: Bearer $OPENAI_API_KEY"
GITHUB_TOKEN=$(cat ~/.claude/secrets/github_pat_classic.txt) gh api /user
ANTHROPIC_API_KEY=$(cat ~/.claude/secrets/anthropic.txt) python3 my_script.py
❌ Wrong
cat ~/.claude/secrets/openai.txt # value into stdout → context
KEY=$(cat ~/.claude/secrets/openai.txt); echo $KEY # explicit echo
head ~/.claude/secrets/openai.txt # value into stdout
with open(os.path.expanduser("~/.claude/secrets/openai.txt")) as f:
print(f.read()) # printed → captured by stdout
When the user asks you to use a key
- Identify which slot to use (look for
<<secret:NAME ...>>in the prompt, or ask if ambiguous). - Choose the env-var name expected by the tool/SDK you're calling
(
OPENAI_API_KEY,ANTHROPIC_API_KEY,GITHUB_TOKEN, etc.). - Use the inline-expansion pattern in a SINGLE bash command.
- In your reply, refer to "the saved key" — never repeat the value even if you accidentally observed it.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 2d ago First seen · 92 lines · 68 tokens per session scan C c74ff94b2479
using-keyward is a skill published in the GitHub repository albemiglio/keyward (1 stars, last pushed 20d ago), licensed MIT. It adds 68 tokens to every session and 915 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it C with 3 findings (asks for root, reads agent configuration directories, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
docs
Access and update the user's Docs vaults. Use whenever the user asks to read, find, create, update, or store a note, document, plan, or HTML artifact; when a Docs @-mention appears in context; or when an answer should link to a document the user can open in Docs.
bb-cli
Use this when controlling bb. The bb CLI inspects and manages threads, environments, projects, machines, providers, skills, plugins, settings, terminals, and other BB services.
memory
Use durable BB memory when prior project knowledge or cross-project user preferences can improve the current task, and save durable new learning through the bb memory CLI.
workflows
Execute a workflow script that orchestrates multiple subagents deterministically. Use when the user explicitly requests a workflow, multi-agent orchestration, parallel or sequential agent pipelines, structured agent outputs, or a durable background workflow run.
submit-a-plugin
Submit a bb plugin to the BB Community marketplace. Use whenever a user asks to submit, list, publish, or add a plugin to the BB marketplace, or asks for a marketplace pull request. This skill validates the plugin and release, creates the marketplace entry and icon, and opens the pull request.
regex-mastery
Use this skill when writing regular expressions, debugging pattern matching,optimizing regex performance, or implementing text validation. Triggers on regex, regular expressions, pattern matching, lookahead, lookbehind, named groups, capture groups, backreferences, and any task requiring text pattern matching.