secchain-mask

Hides SecChain's secret values in prompts, tool results and instructions before the model reads them, through secchain mask.

secchain-mask reaches L1 (reads) by its classified calls and passed claude plugin validate on Claude Code 2.1.302.

Events hooked: 5
API methods referenced: 4
Access from classified calls: L1, reads: reads files, reads env vars, draws
Unclassified calls: 1 ($.process.spawn), full access unknown
Static scan, not a runtime test

To install it, open the repository and follow the author’s setup instructions. Mods need Claude Code 2.1.287 or later.

Access

L1 Reads filesother: $.process.spawn, reads files, reads env vars, draws

Validation

Passed on Claude Code 2.1.302

View the source on GitHub Back to the list

What the scan recorded

Observed events: every prompt, every tool call, the system prompt
Hooks: prompt.submit, tool.call, prompt.section, prompt.context, prompt.attachment
API calls: $.env.get, $.fs.exists, $.process.spawn, $.ui.log
Validation on 2.1.302: Passed
Scanned revision: 388f2156cb90

These are the hooks and API calls reported by claude plugin validate. Access levels describe the widest reach of those calls and are not safety ratings. Validation is a static check, not a runtime test, and a passing result does not prove that a mod works or is safe. How the scan works.

Badge for your README

Authors can show the latest scan result in their README. Each badge links to this page.

[![reach](https://raw.githubusercontent.com/karanb192/awesome-claude-code-mods/main/badges/bannzai--SecChain--secchain-mask-reach.svg)](https://mods.aidojo.si/mods/bannzai--SecChain--secchain-mask/)
[![validates](https://raw.githubusercontent.com/karanb192/awesome-claude-code-mods/main/badges/bannzai--SecChain--secchain-mask-validates.svg)](https://mods.aidojo.si/mods/bannzai--SecChain--secchain-mask/)