← All Skills
🛡️
Agent Guard Secret-Leak Protection
Adds deterministic secret-leak checks at Claude Code and Codex tool boundaries. It blocks sensitive-file reads, credential-like writes, and shell exfiltration patterns, with gitleaks, Git hooks, and CI as defense in depth.
Key Features
- Deterministic pre/post-tool checks
- Sensitive-file and credential-output blocking
- gitleaks, Git-hook, and CI backstops
- Live hook-route probes and degraded reporting
Installation
In Claude Code, add the JeongJaeSoon/agent-guard marketplace, install agent-guard@agent-guard, reload, and run setup-shell. In Codex, add the same marketplace, install Agent Guard in Plugins, review and trust its declared hooks, then run setup-agent-guard.
How to Use
Run the guided setup for read-only diagnosis first. Installing jq, gitleaks, or shell integration requires explicit approval. After check and smoke-test, use harmless PreToolUse/PostToolUse probes to verify the exact client route; report degraded protection if either route is not observed.
Requirements
Supports macOS/Linux and requires jq, gitleaks, plus Claude Code or Codex plugin hooks. Default inspection is local, has no telemetry, and retains no inspected data, but routes not dispatched to hooks remain uncovered. Optional PII HTTP/Pleno adapters send text to a user-configured endpoint, are off by default, and require a privacy/retention review before enablement.
Related Skills