Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add KhaledSaeed18/dotclaude --skill secret-scangit clone --depth 1 https://github.com/KhaledSaeed18/dotclaudeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/khaledsaeed18/dotclaude/secret-scan)<a href="https://agentmods.dev/skills/khaledsaeed18/dotclaude/secret-scan"><img src="https://agentmods.dev/badge/skills/khaledsaeed18/dotclaude/secret-scan.svg" alt="Measured on agentmods" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00049 | $0.00517 |
| Opus 5 | $0.00024 | $0.00259 |
| Sonnet 5 | $0.00010 | $0.00103 |
| Haiku 4.5 | $0.00005 | $0.00052 |
Grade A, and why
secret-scan scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Find secrets that should never be in source control, then advise on remediation. Default scope: the staged diff if there is one, otherwise the working tree. Scan history or a specific path only when asked.
What to look for
- Known credential patterns: cloud keys (AWS
AKIA…, GCP, Azure), provider API tokens (Stripe, GitHubghp_…, Slack, OpenAI, etc.), OAuth client secrets, JWTs. - Private keys & certs:
-----BEGIN … PRIVATE KEY-----blocks,.pem/.p12/ keystore contents. - Credentials in URLs/config: connection strings and URLs with embedded passwords (
scheme://user:pass@host), basic-auth headers. - Generic secrets: assignments to names like
password,secret,token,api_key,access_key,client_secret, plus high-entropy strings that look like keys. - Risky files committed by mistake:
.env, credential JSON,*.key, and their presence in history.
Reduce false positives
Distinguish real secrets from example/placeholder values (xxxxx, your-key-here, changeme), test fixtures, public keys, and sample docs. When genuinely unsure, label a finding "review" rather than asserting a leak, but err toward reporting over silence.
Report and remediate
For each finding give: the file and line, the kind of secret, and a confidence (high / review). Then recommend remediation:
- Rotate the credential immediately. Assume anything committed (even briefly, even if later removed) is compromised. Deleting it from the latest commit is not enough; it remains in history.
- Move the value to an environment variable or a secrets manager and reference it instead of inlining.
- Add the offending file pattern to
.gitignore; consider a pre-commit hook or scanner to prevent recurrence.
This is a defensive check. Report findings so the owner can secure their own project; do not exfiltrate, store, or transmit any secret you find.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 30 lines · 49 tokens per session scan A cabb1e4f7dcd
secret-scan is a skill published in the GitHub repository KhaledSaeed18/dotclaude (5 stars, last pushed 6d ago), licensed MIT. It adds 49 tokens to every session and 517 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.
Other skills, from other repositories
android-development
Android development with Kotlin, Jetpack Compose, and modern Android architecture. Use when building Android apps, implementing Material Design, or following Android best practices.
accessibility-a11y
WCAG 2.2 compliance, ARIA patterns, keyboard navigation, screen readers, automated testing.
ai-ml-development
AI and machine learning development with PyTorch, TensorFlow, and LLM integration. Use when building ML models, training pipelines, fine-tuning LLMs, or implementing AI features.
audio-production
Professional audio production for music, podcasts, and sound design. Use when working with audio recording, mixing, mastering, or sound design for any medium.
authentication-patterns
OAuth 2.0, JWT, SSO, MFA, NextAuth/Clerk/Supabase Auth implementation patterns.
brand-identity
Brand strategy and identity design for businesses and products. Use when creating brand guidelines, developing visual identity systems, or defining brand positioning.