What is secret-governance?

A checker for how applications store, access, and rotate passwords, tokens, certificates, and other secrets.

It reviews secret storage, encryption, access permissions, rotation rules, hardcoded values, environment files, and Kubernetes secret references.

It helps prevent sensitive values from being committed to Git, exposed in logs, or given to services with excessive access.

secret-governance — Skill for Claude Code and Codex by paruff

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add paruff/uFawkesAI --skill secret-governance

Clone the repo

git clone --depth 1 https://github.com/paruff/uFawkesAI

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/paruff/ufawkesai/secret-governance/github.svg)](https://agentmods.dev/skills/paruff/ufawkesai/secret-governance)

Your own site

<a href="https://agentmods.dev/skills/paruff/ufawkesai/secret-governance"><img src="https://agentmods.dev/badge/skills/paruff/ufawkesai/secret-governance/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/paruff/ufawkesai/secret-governance"><img src="https://agentmods.dev/badge/skills/paruff/ufawkesai/secret-governance.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 24 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 478 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00024	$0.00478
Opus 5	$0.00012	$0.00239
Sonnet 5	$0.00005	$0.00096
Haiku 4.5	$0.00002	$0.00048

Measured 8d ago against content hash eff47e49754f, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

secret-governance scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/review/secret-governance/SKILL.md · 97 lines

What it actually says

Skill: Secret Governance Validation

Load trigger: "load secret-governance skill" > DORA: Cap 1 (AI Policy) Token cost: Low

Purpose

Validate secret usage and governance.

Responsibilities

Validate secret storage location and encryption
Validate secret rotation policies
Validate secret access patterns
Detect plaintext secrets

Inputs

Secret manifests
Secret metadata

Outputs

secret-governance.json

Validation Rules

Storage

No plaintext secrets in Git
Secrets encrypted at rest
External secret management used where available
No .env files committed

Access

Secret access restricted via RBAC
Service accounts have minimal secret access
Secret access audited

Rotation

Rotation policy defined for each secret type
No expired certificates or tokens
Automated rotation configured

Patterns

No hardcoded secrets in source code
No secrets in environment variables exposed to logs
Secret references use secretKeyRef
No secrets in ConfigMaps unless clearly non-sensitive

Tools

kubectl get secrets -o yaml
Secret scanning (gitleaks, truffleHog)
grep for plaintext patterns

Output Format

{
  "skill": "secret-governance",
  "status": "pass | fail",
  "checks": [
    {
      "area": "Storage",
      "status": "pass | fail",
      "details": "Description"
    },
    {
      "area": "Rotation",
      "status": "pass | fail",
      "details": "Description"
    }
  ],
  "violations": []
}

Success Criteria

No secret governance violations
No plaintext secrets detected
Rotation policies defined

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

8d ago First seen · 97 lines · 24 tokens per session scan A eff47e49754f

Subscribe to this mod's changes

secret-governance is a skill published in the GitHub repository paruff/uFawkesAI (2 stars, last pushed 19d ago), licensed MIT. It adds 24 tokens to every session and 478 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.

Claude Code DevOps and cloud Security agents-md ai-agents cursor devex dora-metrics

planning-with-files

Persistent file-based planning for multi-step AI-agent work. Keeps taskplan.md, findings.md, and progress.md on disk; lifecycle hooks inject selected project planning context. Automatic recovery reads project planning files only. Explicit session-catchup.py --metadata reads same-project local agent session records and…

mxyhi/ok-skills · 117 tokens

infrastructure-overview

Top-level skill for the research template infrastructure layer. Use in Cursor, Claude Code, or similar agents when editing or importing anything under infrastructure/, understanding the two-layer architecture, or wiring build/validation/rendering/publishing. Covers module discovery, import patterns, thin…

docxology/template · 80 tokens

infrastructure-validation

Skill for the validation infrastructure module providing PDF validation, markdown validation, output integrity checks, link verification, documentation audits, issue categorization, and repository scanning. Use when validating research outputs, checking document quality, running audits, or verifying cross-references.

docxology/template · 54 tokens

template-academic-paper

Template-native manuscript planning, outline, drafting, revision, formatting, citation check, and AI-use disclosure routing. USE WHEN the user asks to write, outline, revise, format, or prepare a paper inside the Research Project Template.

docxology/template · 52 tokens

infrastructure-llm

Skill for the LLM infrastructure module providing local Large Language Model integration via Ollama. Covers client initialization, prompt templates, output validation, manuscript review generation, conversation context, and CLI usage. Use when querying LLMs, generating manuscript reviews, validating LLM outputs, or…

docxology/template · 66 tokens

research-workflow

Seven-stage research workflow (SCOPE→LITERATURE→REASON→DESIGN→COMPUTE→SYNTHESIZE→WRITE). Use for: structuring an AI agent's research process, generating literature review prompts, scoping methodology. Usage: from infrastructure.research import ResearchWorkflow; ResearchWorkflow.describe() Config: set stage overrides…

docxology/template · 91 tokens