Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add makifbaysal/tasktrooper --skill secrets-and-crypto-reviewgit clone --depth 1 https://github.com/makifbaysal/tasktrooperWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/makifbaysal/tasktrooper/secrets-and-crypto-review)<a href="https://agentmods.dev/skills/makifbaysal/tasktrooper/secrets-and-crypto-review"><img src="https://agentmods.dev/badge/skills/makifbaysal/tasktrooper/secrets-and-crypto-review/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/makifbaysal/tasktrooper/secrets-and-crypto-review"><img src="https://agentmods.dev/badge/skills/makifbaysal/tasktrooper/secrets-and-crypto-review.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00051 | $0.01887 |
| Opus 5.5 | $0.00020 | $0.00755 |
| Sonnet 5.5 | $0.00010 | $0.00377 |
| Haiku 4.5 | $0.00005 | $0.00189 |
Grade A, and why
secrets-and-crypto-review scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 4d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Makes network callslowCapability
Not a fault in itself. Listed so you know the mod talks to something, and to what.
exec.Command("curl", "-H", "Authorization: Bearer "+token, url) How it starts
The opening of the file, as written. The whole thing — 116 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Secrets and Crypto Review
Overview
A committed secret is leaked the moment the branch is pushed; deleting it in a later commit does not un-leak it. Crypto bugs are the opposite: invisible in behaviour, obvious in the parameters. Both are found by reading values, not flows.
Core principle: secrets live only in the secret store and in memory; crypto parameters are chosen by the library's safe default, never hand-assembled.
1. Live Secrets in Code (CWE-798) — a blocking category
Recognisable shapes: AKIA…/ASIA… (AWS), ghp_/github_pat_/gho_ (GitHub), xoxb-/xoxp- (Slack), sk_live_/rk_live_ (Stripe), -----BEGIN … PRIVATE KEY-----, a GCP service-account JSON ("type": "service_account"), a database URL with a password, a JWT signing secret, a committed .env, kubeconfig, .npmrc with _authToken, ~/.docker/config.json.
Decide whether it is live before blocking:
- Placeholder (
changeme,xxx,<token>), documented test key (sk_test_), or a value the provider marks publishable (pk_live_, Firebase web config) → not a finding. - Production-shaped, high-entropy, referenced by non-test code, or found by the pipeline's secret scanner as verified → live secret, block.
- Never use the credential to test it. Calling the provider with someone's key is not a review step.
- The fix always includes rotation, not only removal.
- Redact it in your comment to a recognisable prefix (
sk_live_51H…).
2. Secrets Where They Leak
// ❌ token on argv — visible to every local user via ps and /proc
exec.Command("curl", "-H", "Authorization: Bearer "+token, url)
// ✅ the child reads it from its environment or stdin
cmd := exec.Command("curl", "-H", "@-", url); cmd.Stdin = strings.NewReader("Authorization: Bearer " + token)
- Logs (CWE-532): a request, header map, config struct or exception that carries a token, password or session id. Logging a URL is fine; logging one with
?token=is not. - URLs (CWE-598): credentials in query strings end up in access logs, proxies, browser history and
Referer. - Error responses (CWE-209): connection strings, stack traces with secrets, upstream error bodies echoed to the client.
- Client bundles:
NEXT_PUBLIC_*,VITE_*,REACT_APP_*variables and anything in a mobile binary are public. A server secret placed there is leaked by design. - argv (CWE-214): see above.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 4d ago First seen · 116 lines · 51 tokens per session scan A 33c2f0593a41
secrets-and-crypto-review is a skill published in the GitHub repository makifbaysal/tasktrooper (113 stars, last pushed yesterday), licensed Apache-2.0. It adds 51 tokens to every session and 1,887 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-10-09.
Other skills, from other repositories
ramp
Fetch and follow Ramp's published agent playbooks inside Paperclip, with mandatory approval gates for spend, incorporation, cards, account setup, and other financial actions.
paperclip-create-agent
Create new agents in Paperclip with governance-aware hiring. Use when you need to inspect adapter configuration options, compare existing agent configs, draft a new agent prompt/config, and submit a hire request.
agent-crdt-synchronizer
Agent skill for crdt-synchronizer - invoke with $agent-crdt-synchronizer.
github-pr-workflow
Prepare a GitHub pull request from a feature branch — branch hygiene, commit shape, title/body, verification notes, screenshots for UI work, and replies to review comments.
agent-topology-optimizer
Agent skill for topology-optimizer - invoke with $agent-topology-optimizer.
paperclip-task-bridge
Create, comment on, update, and list Paperclip tasks from Hermes using scoped Paperclip API credentials.