How this skill is triggered — by the user, by Claude, or both
Slash command
/secret-mask:secret-maskThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
This project uses secret-mask to protect sensitive values. When you read protected files, secret values appear as `SECRET_VALUE_<KEY>` placeholders (e.g., `SECRET_VALUE_API_KEY`).
This project uses secret-mask to protect sensitive values. When you read protected files, secret values appear as SECRET_VALUE_<KEY> placeholders (e.g., SECRET_VALUE_API_KEY).
The config file is .secretmask/config.json in the target project root. Each key is a file path (relative to project root), each value defines which secrets to mask.
Simple syntax - for KEY=VALUE files (.env, .env.local, etc.):
{
".env": [".*KEY.*", ".*SECRET.*", ".*TOKEN.*", ".*PASSWORD.*"]
}
Value is an array of regex patterns (JavaScript RegExp) that match key names to mask. The default extractor parses KEY=VALUE lines.
Common patterns:
".*KEY.*" - matches any key containing KEY (e.g. API_KEY, PUBLIC_KEY)".*SECRET.*" - matches any key containing SECRET (e.g. CLIENT_SECRET)".*TOKEN.*" - matches any key containing TOKEN (e.g. AUTH_TOKEN)".*PASSWORD.*" - matches any key containing PASSWORD (e.g. DB_PASSWORD)".*API.*" - matches any key containing API (e.g. API_URL - be careful, may be too broad)"^STRIPE_" - matches keys starting with STRIPE_ only"^(DB_PASS|REDIS_AUTH)$" - matches exact key namesPatterns are case-insensitive. Use .* for wildcards, not *.
Advanced syntax - for custom file formats (JSON, YAML, INI, .npmrc, etc.):
{
"credentials.json": {
"patterns": [".*key.*", ".*secret.*"],
"extractor": "^\\s*\"([^\"]+)\"\\s*:\\s*\"([^\"]+)\"\\s*,?\\s*$"
}
}
patterns - array of regex matching key names (same as simple)extractor - regex with exactly 2 capture groups: (1) key name, (2) valueBoth syntaxes can be mixed in the same config.
.secretmask/config.json exists in the project rootnpx claudepluginhub enixcode/secret-maskExtracts hardcoded secrets from CLAUDE.md, .mcp.json, and project config into gitignored .env file, wires SessionStart hook for auto-loading. Use for 'separate secrets' or 'extract API keys'.
Detects API keys, passwords, tokens, and credentials embedded in source code, config files, and test fixtures. Flags hardcoded secrets that could be exposed via version control.
Detects hardcoded secrets, API keys, credentials, tokens, and private keys in source code and git history using regex patterns for pentesting and code reviews.