secret-remediation

secret-remediation is a skill for Claude Code, Codex from tahirraufkeeyu/software-development-agent-stack--sdas. It costs 65 tokens per session (3,255 once invoked), scanned A, original, MIT.

A remediation tool for exposed credentials found by a secret scanner. It rotates affected credentials, removes their values from Git history, and records decisions about false positives.

In plain words
What is it for?
Use it after a secret scan or provider alert identifies leaked credentials in a repository, when you have access to rotate those credentials and rewrite history.
Why use it?
It addresses the risk after a key or token has been committed, including invalidating the old credential and reducing the chance of the leak being reused.

Skill for Claude CodeCodex

Written for no agent in particular: nothing here depends on one.

Needs its repository: it reads a path above its own folder, which exists only inside the repository. The line is git filter-repo --replace-text ../replacements.txt.

Good fit Use it after a secret scan or provider alert identifies leaked credentials in a repository, when you have access to rotate those credentials and rewrite history.

Compare 6 skills from other repositories ↓
Install

Getting it into your agent

It runs from inside its repository, so the clone comes first — what it calls does not travel with the file alone.

Clone the repo
git clone --depth 1 https://github.com/tahirraufkeeyu/software-development-agent-stack--sdas
agentmods
npx agentmods add skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for secret-remediation

README.md
[![agentmods](https://agentmods.dev/badge/skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation/github.svg)](https://agentmods.dev/skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation)
Your own site
<a href="https://agentmods.dev/skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation"><img src="https://agentmods.dev/badge/skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

agentmods 80×15 button for secret-remediation

Your own site · 80×15
<a href="https://agentmods.dev/skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation"><img src="https://agentmods.dev/badge/skills/tahirraufkeeyu/software-development-agent-stack--sdas/secret-remediation.svg" alt="Reviewed on agentmods" width="80" height="20"></a>
Per session 65 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.
When invoked 3,255 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. A grade says what 26 rules found in the file — not that it is safe.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00065 $0.03255
Opus 5 $0.00032 $0.01628
Sonnet 5 $0.00013 $0.00651
Haiku 4.5 $0.00006 $0.00326

Measured 8d ago against content hash 9e39afb3e603, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-11, from the pricing page.

Security

Grade A, and why

secret-remediation scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

- GitHub: `curl -H "Authorization: token <old-pat>" https://api.github.com/user` → must return 401.
departments/security/skills/secret-remediation/SKILL.md · 280 lines

How it starts

The opening of the file, as written. The whole thing — 280 lines — stays where its author put it; the contents beside it link to each section on GitHub.

When to use

  • secret-scanner has produced security/findings/secrets.json containing one or more findings.
  • A collaborator has opened a ticket "leaked credential found in commit X".
  • A secret-rotation deadline is approaching and you need a structured remediation pass.
  • A vendor (GitHub secret scanning, AWS Trusted Advisor) has notified you of a leaked credential.

Do not use this skill to re-scan the repo — that's secret-scanner. Do not use it to triage non-secret high-entropy strings — treat those as false positives and document the allowlist decision here.

Inputs

  • security/findings/secrets.json from secret-scanner, or an equivalent list of findings.
  • Provider console access for every credential type in the findings (AWS, GitHub, Stripe, etc.). Without rotation access this skill cannot complete its primary step.
  • Repo write access and git filter-repo or BFG installed locally.
  • Collaborator list so notification of the forced-push can be scoped.

Outputs

  • security/remediation/secrets-<date>.md — the audit-trail report for this remediation cycle.
  • A rewritten git history on all affected branches (force-pushed) with secret values replaced.
  • .gitleaksignore updates for confirmed false positives only.
  • New prevention controls: pre-commit hook config, CI workflow, secret-manager entry.

Tool dependencies

  • git with git-filter-repo (pip install git-filter-repo) or BFG Repo-Cleaner.
  • gitleaks for pre-commit + CI hooks.
  • Cloud / SaaS provider CLIs: aws, gh, stripe, twilio, gcloud, etc.
  • kubectl if secrets are consumed by Kubernetes workloads.
  • A secret manager: AWS Secrets Manager, HashiCorp Vault, Doppler, 1Password, or similar.

Procedure

  1. Triage. Load security/findings/secrets.json and classify each finding:
    • aws-access-key — starts with AKIA, 20 chars.
    • github-pat — starts with ghp_, gho_, or ghs_.
    • stripe-key — starts with sk_live_ or sk_test_.
    • gcp-service-account — JSON with "type": "service_account".
    • db-connection-stringpostgres://user:pass@host, mysql://…, etc.
    • generic-high-entropy — needs a provenance check.
    • false-positive — SRI hash, JWT in a test fixture, etc. Requires explicit evidence in the report.

Read the full file on GitHub · 280 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 8d ago First seen · 280 lines · 65 tokens per session scan A 9e39afb3e603

Subscribe to this mod's changes

secret-remediation is a skill published in the GitHub repository tahirraufkeeyu/software-development-agent-stack--sdas (18 stars, last pushed 4mo ago), licensed MIT. It adds 65 tokens to every session and 3,255 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.