Secret Redactor
npx claude-code-templates@latest --mod security/secret-redactor Scanned by NVIDIA SkillSpector
Automated static analysis (no LLM) · v2.12.0 · 2026-10-17
Partial analysis: some checks could not run on this component.
SkillSpector looks for patterns such as shell commands, credential access, network calls or unpinned dependencies. An observation is something worth reading in the files before you install, not a confirmed vulnerability. Components that run code locally, like hooks, MCP servers and security tooling, naturally show more of them.
- Agent Config Directory AccessAgent Snooping · README.md:26
- Credential Access ×2Privilege Escalation · tests/secret-redactor.test.ts:15
- MCP server referenced without pinned version: 'npx claude-code-templates'.MCP Rug Pull · README.md:35
Learn more about NVIDIA SkillSpector.
Content
hooks/secret-redactor.ts. Options: patterns (set in user or managed settings pluginConfigs, or /config). Run claude plugin validate on the installed folder to see every event it hooks and every $ call it makes.
secret-redactor
Replaces credential-shaped strings in every tool result before the model
reads it, and refuses to echo a redacted placeholder back into a Bash
command. One tool.call hook: it awaits next(e) (the "after" placement),
deep-replaces every string in what came back and tells the model, through
context, that a redaction happened so it is not confused by placeholders.
This is the shape the engine's author gives for a redactor:
on("tool.call", async ($, e, next) => recursiveStrReplace(await next(e), ...))Seat it as low as possible (an org appends it in managed settings) so no plugin above ever sees the raw value on the way up.
If redaction itself fails (it throws or runs out of its time budget), the output is withheld, never passed on unredacted. The tool has already run by then; only what it printed is kept back.
Options
patterns: string extra regex sources, comma-separated (global flag is added)Declared in .claude-plugin/plugin.json (userConfig). Set them in /config, in user settings (~/.claude/settings.json, not project settings), with --settings <file> or in managed settings:
{ "pluginConfigs": { "secret-redactor@skills-dir": { "options": { } } } }Install
npx claude-code-templates@latest --mod security/secret-redactor
claudeIt is written to .claude/skills/secret-redactor/, which Claude Code auto-loads as secret-redactor@skills-dir. For one session with hot reload: claude --plugin-dir .claude/skills/secret-redactor. claude plugin validate .claude/skills/secret-redactor prints every event it hooks and every $ call it makes.
Requirements. Mods are on by default in Claude Code 2.1.287+. Typed against Anthropic's declarations: https://github.com/anthropics/claude-code/tree/main/mods