Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx agentmods add skills/backspace-shmackspace/claude-devkit/secrets-scannpx skills add backspace-shmackspace/claude-devkit --skill secrets-scangit clone --depth 1 https://github.com/backspace-shmackspace/claude-devkitWhat it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5 | $0.00037 | $0.05594 |
| Opus 5 | $0.00018 | $0.02797 |
| Sonnet 5 | $0.00007 | $0.01119 |
| Haiku 4.5 | $0.00004 | $0.00559 |
Grade A, and why
secrets-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 3d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 450 lines — stays where its author put it; the contents beside it link to each section on GitHub.
/secrets-scan Workflow
Output Rules
- Always print full absolute paths for all artifact references (plan files, review files, audit logs). This makes paths clickable in terminals like Warp. Use the resolved
$PLANS_DIRvalue, never relative paths.
Role
This skill is a pipeline coordinator. It orchestrates a sequential secrets detection workflow using pattern-based scanning. It delegates grep/regex scanning to Bash and synthesis to analysis tasks. It does NOT require external tools like trufflehog or gitleaks — all scanning uses built-in grep patterns, making it self-contained and deployable anywhere Claude Code runs.
Zero tolerance policy: Any confirmed secret detected results in a BLOCKED verdict. There is no passing threshold — secrets in code are a critical finding.
Report redaction rule: This skill NEVER includes actual secret values in reports. Reports show secret type, file path, and line number only. Pattern matches are redacted to show type and location: e.g., "AWS Access Key at src/config.js:42".
Inputs
- Scan scope: $ARGUMENTS
staged(default) — scan git staged files only (pre-commit gate)all— scan entire working directoryhistory— scan git commit history (use for post-incident review)
Step 0 — Pre-flight checks
Resolve devkit paths (MUST be first action in Step 0):
Tool: Bash
# --- Devkit Path Resolution ---
DEVKIT_SCRIPTS="${CLAUDE_DEVKIT:-$HOME/.claude-devkit}/scripts"
# Source path resolution helper
if [ -f "$DEVKIT_SCRIPTS/resolve-project-dir.sh" ]; then
. "$DEVKIT_SCRIPTS/resolve-project-dir.sh"
DEVKIT_PROJECT_DIR_RESOLVED=$(resolve_devkit_project_dir) || {
echo "Failed to resolve project directory" >&2; exit 1
}
elif [ -n "${DEVKIT_PROJECT_DIR:-}" ]; then
DEVKIT_PROJECT_DIR_RESOLVED="$DEVKIT_PROJECT_DIR"
else
echo "WARNING: devkit is not installed. Using deprecated .devkit/ fallback." >&2
DEVKIT_PROJECT_DIR_RESOLVED=".devkit"
fi
PLANS_DIR="$DEVKIT_PROJECT_DIR_RESOLVED/plans"
mkdir -p "$PLANS_DIR"
echo "Plans directory: $PLANS_DIR"
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 3d ago First seen · 450 lines · 37 tokens per session scan A c9bab3fb32a7
secrets-scan is a skill published in the GitHub repository backspace-shmackspace/claude-devkit (15 stars, last pushed 9d ago), licensed MIT. It adds 37 tokens to every session and 5,594 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
document
Run /document pr | changelog | release-note | postmortem (or let it ask) to write the human facing prose about a change. Drafts from the real commits and diff, writing to the right place. Does not write code, tests, or specs.
lesson-close
Закрыть текущее занятие. Финализирует lesson/YYYY-MM-DD.md (frontmatter status, метаданные времени, длительность), делает commit + push в репо DS-personal-guide. Триггерит замкнутый контур доставки — после push → GitHub webhook → bot oauthserver.py:/webhook/github/workbook → synconeusertodt → ЦД обновляется в Neon.…
commit
Git diff を分析し Conventional Commits 形式のメッセージを生成してコミットを実行する。.
hf.scan-secrets-before-commit
Skill "hf.scan-secrets-before-commit" from T-rav/hydraflow, covering hf.scan-secrets-before-commit, fires on pretooluse for bash commands matching git commit, only intercept git commit commands, get staged files and build combined regex.
git-commit-guide
通用 Git 提交原则——提交时机、信息格式、提交前自检。Use when the user is about to commit code, asks about commit messages, or after completing a functional unit of work.
Secrets Scan Checklist
Common credential shapes to recognize in a diff (API keys, tokens, connection strings, private key blocks) and the escalation rule to follow when one is found.