Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add CiscoDevNet/essentials --skill mcp-hide-secretsgit clone --depth 1 https://github.com/CiscoDevNet/essentialsWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/ciscodevnet/essentials/mcp-hide-secrets)<a href="https://agentmods.dev/skills/ciscodevnet/essentials/mcp-hide-secrets"><img src="https://agentmods.dev/badge/skills/ciscodevnet/essentials/mcp-hide-secrets/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/ciscodevnet/essentials/mcp-hide-secrets"><img src="https://agentmods.dev/badge/skills/ciscodevnet/essentials/mcp-hide-secrets.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00103 | $0.01272 |
| Opus 5.5 | $0.00041 | $0.00509 |
| Sonnet 5.5 | $0.00021 | $0.00254 |
| Haiku 4.5 | $0.00010 | $0.00127 |
Grade B, and why
mcp-hide-secrets scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
scripts/run.sh fix-launchagents # sudo in Terminal when agent cannot prompt How it starts
The opening of the file, as written. The whole thing — 104 lines — stays where its author put it; the contents beside it link to each section on GitHub.
MCP Hide Secrets (macOS — LaunchAgent + .env)
Move live credentials out of ~/.cursor/mcp.json and/or a project .cursor/mcp.json into ~/.local/share/cursor-mcp/mcp.env, loaded at login by a macOS LaunchAgent via launchctl setenv. Cursor interpolates ${env:VAR} in MCP env and headers blocks.
Agent workflow (required)
Run only scripts/run.sh. Do not write ad-hoc preflight, migrate, or verify commands.
# From this skill root (set PROJECT_MCP_JSON when a repo .cursor/mcp.json should be included):
chmod +x scripts/run.sh
USERNAME="$(whoami)" PROJECT_MCP_JSON="<repo>/.cursor/mcp.json" scripts/run.sh
USERNAME="$(whoami)" scripts/run.sh migrate
USERNAME="$(whoami)" scripts/run.sh status
scripts/run.sh fix-launchagents # sudo in Terminal when agent cannot prompt
Never read or display secret values from mcp.json or mcp.env. Report script output only.
| User says | Script |
|---|---|
/mcp-hide-secrets |
scripts/run.sh (default) |
/mcp-hide-secrets migrate |
scripts/run.sh migrate [optional mcp.json path] |
/mcp-hide-secrets status |
scripts/run.sh status |
/mcp-hide-secrets install |
scripts/run.sh install (after fix-launchagents) |
If sudo fails in a non-interactive shell, ask the user to run scripts/fix-launchagents-dir.sh in Terminal, then USERNAME="$(whoami)" scripts/run.sh install.
After success: user quits Cursor (Cmd+Q) and reopens from Dock.
MCP config targets
| Location | Path |
|---|---|
| Global | ~/.cursor/mcp.json |
| Project | <repo>/.cursor/mcp.json |
Both merge into ~/.local/share/cursor-mcp/mcp.env. Default run.sh migrates global first, then project when PROJECT_MCP_JSON is set. Migrate dirty files separately with scripts/run.sh migrate <path>.
Gotchas (keep in SKILL.md)
- Dock-launched Cursor does not see
~/.zshrcexports — session env via LaunchAgent is required. ~/Library/LaunchAgentsis sometimes owned byroot;fix-launchagents-dir.shis a normal step, not a one-off fix.- Migrate runs before LaunchAgent install so secrets move even when sudo is pending.
- A server named
github(any case) dropsheaderson migrate so OAuth can run.
What ships with it
16 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- LICENSE 11 KB
- references/install-cursor.md 1.5 KB
- references/launchagent-naming.md 1.4 KB
- references/launchctl.md 3.6 KB
- references/rationale.md 5.6 KB
- scripts/check-inline-secrets.py 1.6 KB runs code
- scripts/fix-launchagents-dir.sh 1.5 KB runs code
- scripts/install.sh 5.7 KB runs code
- scripts/lib.sh 819 B runs code
- scripts/load-mcp-env.sh 1.5 KB runs code
- scripts/local.your-username.cursor-mcp-env.plist 615 B
- scripts/mcp.env.example 501 B
- scripts/preflight.sh 1.7 KB runs code
- scripts/run.sh 3.1 KB runs code
- scripts/status.sh 1.3 KB runs code
- scripts/verify.sh 959 B runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 104 lines · 103 tokens per session scan B 85463bb7692b
mcp-hide-secrets is a skill published in the GitHub repository CiscoDevNet/essentials (7 stars, last pushed 17d ago), licensed Apache-2.0. It adds 103 tokens to every session and 1,272 once invoked, about $0.0004 per session on Opus 5.5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-04.
Other skills, from other repositories
writing-blogs
Writes, structures, and formats SEO-optimized blog posts for the Appwrite blog following established conventions for voice, tone, frontmatter, and post structure. Use when the user asks to write, draft, create, or outline a blog post, or when working with files in src/content/blog/posts/.
create-announcement
Coordinates the three artifacts that ship a new Appwrite feature announcement: docs updates under src/content/docs/, an announcement blog post under blog/announcing- /, and a changelog entry under src/content/changelog/entries/. Use when the user asks to announce, launch, or ship a feature, product, SDK, runtime…
auditing-seo
Audits Appwrite blog posts for SEO, AEO, content structure, links, metadata, and search intent. Use when the user asks for an SEO audit, SEO review, search optimization check, or pre-publishing SEO assessment.
reviewing-blogs
Reviews and critiques blog posts in src/content/blog/posts/ against Appwrite's established standards for voice, tone, structure, SEO, formatting, and accuracy. Use when the user asks to review, audit, critique, or improve an existing blog post.
lookup-agent-run
Find an eve Agent Run from a run ID, project, request reference, or approximate time using authorized evidence available to the consumer.
dashboard-chat-best-practices
Apply dashboard-grade chat UX patterns in the Eve chat template. Use when changing Next.js Cache Components/PPR behavior, static shell layout, Suspense bootstrap boundaries, theme hydration, auth display hydration, signed-in/signed-out static shell behavior, optimistic messages, streaming row identity…