Claude Code mod

secret-mask

Masks secrets (API keys, tokens, passwords, .env values) in tool output and prompts before Claude reads them

Guard & safety mods Plugin marketplaceValidates on Claude Code 2.1.316 Source

Install

Inside Claude Code
/plugin marketplace add mashabek/claude-mods
/plugin install secret-mask@skills

Mods install like plugins. Run /reload-plugins or start a new session to load it.

What it can access

Reach
L2Writes or runs: runs processes, reads files, reads env vars, persists state, draws
Hooks
session.startprompt.composesession.appendcommand.run

From a static scan of the mod's code by awesome-claude-code-mods. It shows what the code asks for, not a security review.

How Claude Code mods work

  • A mod is a plugin with a JavaScript or TypeScript module that runs inside Claude Code (version 2.1.287 or later). It can draw panes beside the transcript, a band above the prompt, buttons and toasts, restyle the spinner and tool rows, and watch or rewrite tool calls and prompts.
  • It installs like any plugin: add its marketplace with /plugin marketplace add owner/repo, then /plugin install name@marketplace.
  • Check what a mod can reach before installing: it runs with your permissions. Reach goes from drawing only, to reading files, to writing files or running processes, to the network. Run claude plugin validate on a clone to list its hooks and calls without running it.
  • Turn one off from the Installed tab in /plugin, or start Claude Code with --safe-mode to skip every customization for a session.
Claude Code docs

Details

Repository
mashabek/claude-mods
Folder
plugins/secret-mask
Marketplace
skills
Author
mashabek
Type
Guard & safety mods
Website
github.com/mashabek/skills/tree/main/plugins/secret-mask
License
MIT
Last updated
28 October 2026
Listed in
awesome-claude-code-mods

FAQ

What is secret-mask?

Masks secrets (API keys, tokens, passwords, .env values) in tool output and prompts before Claude reads them It is a mod for Claude Code, from mashabek/claude-mods on GitHub.

What can the secret-mask mod access?

Its widest reach is "writes or runs" (runs processes, reads files, reads env vars, persists state, draws). Like any mod, it runs with your permissions.

How do I install secret-mask?

Inside Claude Code (v2.1.287 or later), run /plugin marketplace add mashabek/claude-mods and then /plugin install secret-mask@skills.

More guard & safety mods

secret-guard

verastack-labs/secret-guard

Blocks API keys, tokens and private keys from being written to disk, put on a command line, or committed to git by Claude.

Guard & safety mods/plugin install

secret-mod

zyx1121/secret-mod

Ask for credentials in a form, keep them in the macOS keychain, and run commands with them without showing the values to Claude

Guard & safety mods/plugin install

secret-guard

tksunw/secret-guard

Blocks git commit and git push from Claude when the change carries a secret file or a credential-shaped line, and flags secret files that are not gitignored

Guard & safety mods

secret-redactor

jidhra/claude-mods

Keeps secrets, email addresses and IP addresses out of the session transcript: swaps each one for a stable placeholder on the way in, and puts the real value back on the way into a tool call

Guard & safety mods/plugin install

secret-guard

Sajid-Rahman0126/claude-studio-mods

Stops Claude from reading or editing .env files, private keys and credential files, including through symlinks and shell commands

Guard & safety mods/plugin install

secret-sentry

ccdwyer/secret-sentry

Two-way secret scrubbing: redacts credentials before the model sees them and blocks writing them into tracked files or shell commands

Guard & safety mods

Browse the most popular Claude Code mods, all guard & safety mods, or the skills and MCP server directories.