Claude Code mod
secret-guard
Stops before Claude writes API keys, tokens, private keys or a non-ignored .env into files, git add or commits. Exceptions for test keys and example files: /secret-allow.
Install
/plugin marketplace add LupusMalusDeviant/mod-box
/plugin install secret-guard@mod-boxMods install like plugins. Run /reload-plugins or start a new session to load it.
What it can access
- Reach
- L2Writes or runs: runs processes, writes files, reads files, reads env vars, reads mod state, persists state, draws
- Sees
- every tool call
- Draws in
Pane- Hooks
session.startcommand.runtool.callui.render
From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.
How Claude Code mods work
- A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
- It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
- Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
- Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Details
- Repository
- LupusMalusDeviant/mod-box
- Folder
plugins/secret-guard- Marketplace
mod-box- Author
- Lupus Malus Deviant
- License
- MIT
- Last updated
- 26 October 2026
- Listed in
- awesome-claude-code-mods
FAQ
What is secret-guard?
Stops before Claude writes API keys, tokens, private keys or a non-ignored .env into files, git add or commits. Exceptions for test keys and example files: /secret-allow. It is a mod for Claude Code, from LupusMalusDeviant/mod-box on GitHub.
What can the secret-guard mod access?
Its widest reach is "writes or runs" (runs processes, writes files, reads files, reads env vars, reads mod state, persists state, draws). It sees every tool call. It draws in Pane. Like any mod, it runs with your permissions.
How do I install secret-guard?
Inside Claude Code (v2.1.287 or later), run /plugin marketplace add LupusMalusDeviant/mod-box and then /plugin install secret-guard@mod-box.
Is secret-guard popular?
LupusMalusDeviant/mod-box has 1 GitHub stars and 0 forks, and is included in 1 curated Claude Code list. It was last updated on 26 October 2026.
More guard & safety mods
course-correct
1Akash001uts/claude-mods
Adds a note for Claude when it goes round in circles on the same error, says it's done without checking, or slips into writing habits you've banned. Never blocks anything
open-file-guard
3seanrobertwright/claude-mods
Before Claude uses a Word, Excel or PowerPoint file you have open, asks you to close it instead of letting the write fail.
checkpoint
5partalemre/MODZ
Silent git snapshot before each turn's first file write; /checkpoints lists turns and undoes one after a confirm
blast-radius
harshitmywork17/claude-mods
Catches risky shell commands (rm -rf, git reset --hard, force push, ...) before they run, forces a permission prompt, and shows what they would touch in a side pane.
prompt-time
12KilimcininKorOglu/claude-code-mods
Draws the time under each of your messages and each text block of the model's replies, also for a resumed session whose transcript is 4 MiB or smaller. Display only: nothing reaches the model.
cortex-guard
cdeust/claude-mods
Two rules no settings hook enforces, refused at the tool call: wiki pages and their generated ADR mirrors are written only through the Cortex wiki tool, and every git worktree lives at <repo>/.claude/worktrees/<name>/ (one created there is registered with disk_hygiene.py).
Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.