Getting it into your agent
There is no command for this one: it runs only inside a plugin, and the catalogue could not identify which plugin ships it. The source is linked below.
Wrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/joelhooks/agent-secrets/secret-management)<a href="https://agentmods.dev/skills/joelhooks/agent-secrets/secret-management"><img src="https://agentmods.dev/badge/skills/joelhooks/agent-secrets/secret-management.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00053 | $0.02834 |
| Opus 5 | $0.00026 | $0.01417 |
| Sonnet 5 | $0.00011 | $0.00567 |
| Haiku 4.5 | $0.00005 | $0.00283 |
Grade B, and why
secret-management scanned grade B with 2 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootmediumPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
chmod 600 ~/.agent-secrets/identity.age Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
curl -H "Authorization: Bearer $ANTHROPIC_API_KEY" https://api.anthropic.com/... How it starts
The opening of the file, as written. The whole thing — 396 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Secret Management for AI Agents
This skill enables AI agents to securely manage and access credentials using agent-secrets, a Go CLI that provides:
- 🔐 Age encryption for secrets at rest
- ⏱️ Session-scoped leases with automatic expiration
- 🔄 Auto-rotation hooks for dynamic credentials
- 🚨 Multi-factor killswitch for emergency revocation
- 📋 Append-only audit logging
When to Use This Skill
Use agent-secrets when your agent needs to:
- Access API keys, tokens, or credentials securely
- Prevent credential exfiltration in case of compromise
- Maintain an audit trail of secret access
- Enable time-bounded credential access with automatic expiration
- Support credential rotation without manual intervention
- Implement emergency revocation across all active sessions
Prerequisites
The secrets CLI must be installed and in your PATH:
# Install (see repo README for build instructions)
# https://github.com/joelhooks/agent-secrets
# Initialize the encrypted store (run once per machine)
secrets init
# Discover command tree and capabilities
secrets
This creates:
~/.agent-secrets/identity.age— X25519 private key (0600 permissions)~/.agent-secrets/secrets.age— encrypted secrets store~/.agent-secrets/config.json— configuration~/.agent-secrets/agent-secrets.sock— daemon socket
Core Workflows
1. Discover Commands and Secret Names
Use discovery-first commands before requesting a lease:
# Root command returns JSON command tree with usage and next_actions
secrets
# List all stored secret names and lease metadata
secrets list
2. Adding Secrets
Interactive mode (prompts for secret value):
secrets add my_secret
With rotation hook (auto-refresh on expiration):
secrets add github_token --rotate-via "gh auth refresh"
secrets add aws_token --rotate-via "aws sts get-session-token --duration-seconds 3600"
From stdin (pipe secret value):
echo "sk-ant-api03-..." | secrets add anthropic_key
cat service-account.json | secrets add gcp_credentials
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 396 lines · 53 tokens per session scan B 14085fd05074
secret-management is a skill published in the GitHub repository joelhooks/agent-secrets (105 stars, last pushed 4d ago), licensed MIT. It adds 53 tokens to every session and 2,834 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it B with 2 findings (asks for root, makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dd-code-generation
Use pup CLI for immediate Datadog operations or generate code for integration into applications.
write-zot-themes
Help the user create, install, or package zot themes, including theme-only extensions.
gograph
Go repository intelligence for Claude Code. Use when reading, navigating, editing, reviewing, or refactoring a Go codebase. Exposes 64 query, analysis, and workflow capabilities through the local gograph MCP server, including bounded first-call exploration, AST-aware call graphs, blast-radius analysis, impact, and…
bubbletea-testing
Use this skill whenever writing tests for Bubble Tea (charmbracelet/bubbletea) TUI applications in Go. Triggers include any mention of testing Bubble Tea models, teatest, golden file testing for TUIs, testing tea.Cmd or tea.Msg, snapshot testing terminal output, or writing tests for any Go CLI/TUI that uses the Elm…
pi-loop-forensics
Diagnose pi-go agent loops and degenerate turns — "agent loop aborted", runaway thinking with no tool calls, repeated phrases. Discriminates genuine model repetition collapse from a race, a tool-parse failure, or a too-low guard, and A/B replays a seed session across providers.
nightly-session-watch
Nightly sweep of the last 24h of pi-go sessions — anomalous runs, loop aborts, tool error rates, token waste, real prompt-token spend, and whether the observation and palace pipelines are still recording. Triages each finding to the specialist skill that diagnoses it. Use for an unattended daily health check, or on…