secret-shield
by slopshopper · ★ 0 · updated yesterday
Keeps secrets out of the transcript and out of the repo: redacts API keys, tokens, private keys and password URLs from tool results before Claude reads them, and refuses a Write, Edit or Bash command that embeds one.
Install
git clone https://github.com/ryx2/slopshopperclaude --plugin-dir ./slopshopper/mods/secret-shieldThen run /reload-plugins or start a new session. Requires Claude Code 2.1.287+.
What it hooks into
From an automated scan with claude plugin validate, not a security review. Mods run with your permissions; read the code before installing.
- Events
session.startturn.startcommand.runtool.callsession.appendui.render- API calls
$.command.register$.state.get$.state.set$.ui.resolve$.ui.toast- Draws
AbovePrompt- Can see
Write|Edit callsBash calls- Reach
- level 1 of 3 other: $.state.getother: $.state.setdraws
Origin
- How it got here
- Automated scan of public GitHub repos, via the CC0 dataset awesome-claude-code-mods (scan of ).
- Repository
- github.com/ryx2/slopshopper
- Path in repo
mods/secret-shield- Source commit
8db7546the exact code the scan read- Author
- slopshopper @ryx2
- License
- MIT
- First published
- Last pushed
- First listed here
Name and description come from the mod's own manifest. We link to the code; we don't host it, and it stays under its author's license.
More from ryx2/slopshopper
burn-rate
ryx2/slopshopper
A fuel gauge above the prompt: context window fill, tokens in and out, dollars spent, dollars per hour, your plan's rate-limit window, and a sparkline of the last turns. Warns once when compaction is near.
receipts
ryx2/slopshopper
A ledger of what Claude touched this session: files created and edited, commands run and whether they failed, the git diffstat after each turn. /receipts prints it as Markdown for a PR description or a standup, or copies it to the clipboard.
slop-detector
ryx2/slopshopper
Catches slop as Claude writes it: refuses a file edit that replaces code with a '... rest of the code' placeholder, and tracks TODO stubs, not-implemented throws, debug prints, @ts-ignore and other leftovers in a band above the prompt and a /slop pane.
test-pulse
ryx2/slopshopper
Runs your test suite after every turn in which Claude changed source, and keeps the result above the prompt: green with the pass count, red with the first failing test. Detects bun, npm, pytest, cargo and go, or runs the command you set. Toasts on a regression and a recovery.
tripwire
ryx2/slopshopper
Holds destructive commands until you say so: rm -rf, force pushes, git reset --hard, DROP TABLE, curl | sh, sudo, chmod -R 777, edits to .env. One question in Claude's own dialog, fail-closed if the guard itself breaks, and a /tripwire log of every decision.