Claude Code mod
secret-box
Claude can use a secret without seeing it: a masked box saves keys to .env and gives Claude a placeholder, every key a tool prints comes back as a placeholder, and committing .env is refused
Install
/plugin marketplace add abdul-raafai-asim/claude-code-mods
/plugin install secret-box@claude-code-modsMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, writes files, drives Claude, reads files, draws
- Sees
- every prompt, every tool call, the system prompt, subagent spawns, Bash calls, /"^(Bash|Read|Grep|Edit|MultiEdit|NotebookEdit)$"/ calls, mcp__secret-box__request_secret calls
- Draws in
PaneAbovePrompt- Hooks
prompt.submittool.callprompt.contextprompt.attachmentprompt.mentionagent.spawnsession.startui.renderui.close
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- abdul-raafai-asim/claude-code-mods
- Folder
plugins/secret-box- Marketplace
claude-code-mods- Author
- Ray Amjad
- License
- MIT
- Last updated
- 30 October 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is secret-box?
Claude can use a secret without seeing it: a masked box saves keys to .env and gives Claude a placeholder, every key a tool prints comes back as a placeholder, and committing .env is refused It is a mod for Claude Code, from abdul-raafai-asim/claude-code-mods on GitHub.
What can the secret-box mod access?
Its widest reach is "writes or runs" (runs processes, writes files, drives Claude, reads files, draws). It sees every prompt, every tool call, the system prompt, subagent spawns, Bash calls, /"^(Bash|Read|Grep|Edit|MultiEdit|NotebookEdit)$"/ calls, mcp__secret-box__request_secret calls. It draws in Pane, AbovePrompt. Like any mod, it runs with your permissions.
How do I install secret-box?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add abdul-raafai-asim/claude-code-mods and then /plugin install secret-box@claude-code-mods.
More guard & safety mods
secchain-mask
bannzai/SecChain
Hides SecChain's secret values in prompts, tool results and instructions before the model reads them, through secchain mask.
secret-guard
0xGondarxyz/claude-code-mods
Masks API keys and tokens in tool results before Claude reads them, and blocks a git push that would leak secrets or home paths to a public repo.
seatbelt
aayanrehman/crew-hq
Blocks destructive commands (rm -rf, force push, reset --hard, DROP TABLE) and .env edits before they run
secret-guard
hagaybar/claude-secret-guard
Keeps API keys, tokens and passwords out of the transcript, tool output, files, commits, PRs and issues.
sdd-analyze-gate
fib1618agent/claude-mod-speckit
SDD capability 04: semantic Analyze findings, read-only run guard (best effort), Analyze result state. Execution is delegated through the Review Gate.
secret-guard
nicolas-fer/secret-guard
Bloqueia prompts e saídas de ferramentas que contenham chaves/segredos antes de chegarem ao modelo
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.