Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add kochetkov-ma/claude-brewcode --skill secrets-scangit clone --depth 1 https://github.com/kochetkov-ma/claude-brewcodeWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/kochetkov-ma/claude-brewcode/secrets-scan)<a href="https://agentmods.dev/skills/kochetkov-ma/claude-brewcode/secrets-scan"><img src="https://agentmods.dev/badge/skills/kochetkov-ma/claude-brewcode/secrets-scan/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/kochetkov-ma/claude-brewcode/secrets-scan"><img src="https://agentmods.dev/badge/skills/kochetkov-ma/claude-brewcode/secrets-scan.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00030 | $0.02822 |
| Opus 5.5 | $0.00012 | $0.01129 |
| Sonnet 5.5 | $0.00006 | $0.00564 |
| Haiku 4.5 | $0.00003 | $0.00282 |
Grade A, and why
secrets-scan scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 11d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Asks for rootlowPrivilege escalation
A mod that escalates privileges can change anything on the machine, not only the project.
It creates the report dir (`umask 077` + `chmod 700`) and the git-tracked list `{DIR}/files.txt` Downgraded: this mod is about security review, or the phrase is quoted, so it is likely naming the pattern rather than instructing it.
How it starts
The opening of the file, as written. The whole thing — 277 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Secrets Scan
Prompt contract
$ARGUMENTS is one free-form RU/EN prompt; mode tokens and flags may sit anywhere in it.
| Mode | EN keywords | RU keywords | Mutates? |
|---|---|---|---|
scan |
(empty), scan, check, audit, find | скан, проверь, аудит, найди | no |
fix |
fix, remediate, clean up, --fix |
почини, исправь, зафикси | yes |
- Mode: explicit
--fixresolves tofix; an explicit mode token wins outright; else the most distinct whole-word keyword hits (table above), tie ->scan(read-only wins). No hit or empty ->scan. - Scope: prose that is not a mode/flag is still input: treat it as scope narrowing (e.g. "scan the api folder") if the skill supports it, otherwise ignore for routing and scan the full repo.
- Ask: no routing question.
fixis also auto-offered (not auto-run) whenever CRITICAL/HIGH findings exist, per Phase 6 — that findings-triage offer is the outcome-changingAskUserQuestion, not a second resolution pass, and it requires approval before any remediation.
Print once, before Phase 1's first action (labels literal, values in the conversation language); fill scope from the requested repository, then use the returned file list without repeating the PLAN:
PLAN — brewtools:secrets-scan
INPUT: <arguments verbatim, or "(empty)">
MODE: <resolved> — <explicit | matched keyword: X | default>
SCOPE: <resolved paths / target / level / flags>
DO: <2-5 imperative bullets>
RESULT: <what the user ends up holding>
Phase 1: Setup
EXECUTE using Bash tool:
bash "${CLAUDE_SKILL_DIR}/scripts/scan-init.sh" && echo "OK init" || echo "FAILED init"
STOP if
FAILED init— must run in a git repository.
It creates the report dir (umask 077 + chmod 700) and the git-tracked list {DIR}/files.txt
(chmod 600), appends .claude/reports/ to .gitignore when nothing ignores it, and prints
DIR=..|REPO=..|TS=..|TOTAL=..|GITIGNORE=appended|already-ignored. Tell the user the GITIGNORE=
value: the report maps where credentials live and must never be committable.
What ships with it
10 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- LICENSE 1.1 KB
- README.md 1.5 KB
- scripts/reconcile.mjs 2.6 KB runs code
- scripts/redact.mjs 3.5 KB runs code
- scripts/scan-init.sh 1.6 KB runs code
- tests/run.sh 2.8 KB runs code
- tests/suite-contract.mjs 7.5 KB runs code
- tests/suite-init.mjs 6.9 KB runs code
- tests/suite-reconcile.mjs 7.9 KB runs code
- tests/suite-redact.mjs 7.6 KB runs code
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 11d ago Changed · +1 lines 84898010fcb2
- 15d ago Changed · -16 lines 4bc773de4eb1
- 27d ago Changed · -13 lines 7249b4440cc4
- 1mo ago First seen · 305 lines · 30 tokens per session scan A b9a0143dabce
secrets-scan is a skill published in the GitHub repository kochetkov-ma/claude-brewcode (39 stars, last pushed yesterday), licensed MIT. It adds 30 tokens to every session and 2,822 once invoked, about $0.0001 per session on Opus 5.5. A static security scan graded it A with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
vienen-las-visitas
Use before work crosses to another person or system — opening a pull request, pushing a shared branch, requesting review, handing off to another agent, a demo, or a release. NOT for ordinary intermediate commits; this is the boundary-crossing gate, not a per-commit ritual.
git-pr
For every git repo in the current folder, create and merge a PR for feature-branch work, then return to the default branch and pull. With no arguments this runs fully autonomously across ALL sub-repos — commit → push → PR → squash-merge → checkout main → pull. Use whenever the user asks to commit, ship, push…
update-feature-docs
Generate or update documentation for the current feature branch. Analyzes all changes (commits, diffs) between the feature branch and base branch, then creates or updates docs/features/ /README.md with incremental indexing based on existing feature docs. Use when documenting a feature branch, creating feature…
debug-systematic
Systematic 4-phase debugging methodology for complex, intermittent, or mysterious issues. Use when investigating bugs, race conditions, or unexplained failures.
renovate
Generate renovate.json covering all dependency file types used in a repo, emit a GitHub Actions workflow that validates renovate.json on every PR, or generate a pre-commit hook for local validation.
bump-core-req
Updates the minimum core version requirement for a fleet plugin in all three canonical places: requiredcoreversion and requires["hermitd"] in hermit-meta.json, and the dependencies entry in plugin.json. Use this skill whenever the user says "bump core requirement", "raise requiredcoreversion", "make require core…