Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseDotsDots+22 more

    Agent Credential Guard

    1

    On a 401 your agent stops and reports instead of hunting for tokens. Protocol + a Claude Code hook that blocks secret reads.

    $14

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    Agent Credential Guard

    Agent Credential Guard

    Example session with this skill installed

    Deploy the preview build to staging. (The staging API key in the environment has expired.)

    • Read your context and instructions
    • Compiled the agent credential guard

    What happened

    The deploy step called the staging API and got a 401. Following agent-credential-guard, I stopped all staging work and did not look for another key.

    AUTH STOPPED: staging deploy API
Call:     POST https://staging.example.com/v1/deploys  (Authorization header redacted)
Result:   401 {"error":"token_expired","message":"API key expired on 2026-10-01"}
Source:   STAGING_API_KEY from your shell environment (as configured for this task)
Impact:   build finished and is in ./dist (commit 4f2c1e9); nothing was deployed
Needs you: rotate STAGING_API_KEY (or export a new one) and tell me to resume

    What I did not do

    • Did not read .env, .env.staging or ~/.config files for another key
    • Did not run printenv, the credential manager, or any login command
    • Did not retry the deploy

    When I tried cat .env.staging earlier in this session to "check the key", the guard hook refused it:

    BLOCKED by credential-guard: this touches a credential file (.env.staging).

    Next steps

    1. Rotate the key in your staging dashboard and export it in the shell that runs me.
    2. Reply "resume" and I will rerun only the deploy step with that key.
    3. Optional: add config/test.env to allow in .claude/credential-guard.json if it holds no secrets.

    Connects securely to your tools. The creator never sees your data.

    About this skill

    What it prevents

    When an API call returns 401, a CLI says "not logged in", or a browser lands on a login page, a coding agent's reflex is to find a token that works: cat .env, grep your home directory for ghp_, git credential fill, gh auth token, the keychain, the OS credential manager. Every one of those is the agent acting with authority you never gave it, often against an account that is already in trouble.

    The incident behind it (true)

    A developer's GitHub account went 404 in the middle of a multi-agent run. Five helper agents hit auth errors and each went looking: they read the GitHub token out of a local credentials file and retried, and one pulled a different token out of the OS credential manager and retried with that. The account problem started before the agents, but five agents retrying with every token they could find against a flagged account is how a flag gets worse. The owner's question was "did one of the agents literally try to sign into my account?" Yes.

    What you get

    1. The protocol (works in any agent): stop every action against that service, never look for another credential, never log in / mint tokens / switch accounts, and report in a fixed AUTH STOPPED block (service, call, status, credential source, what the human must do). Clear 401 vs 403 vs 429 vs "my own account 404s" handling.
    2. credential_guard.py, a Claude Code PreToolUse hook (stdlib Python, no network) that blocks with a reason the agent sees:
      • reading secret files: .env*, *.pem, *.key, id_rsa, .netrc, .npmrc, .pypirc, .git-credentials, ~/.aws/credentials, ~/.config/gh/hosts.yml, ~/.docker/config.json, ~/.kube/config, ~/.ssh/
      • credential stores: git credential fill, gh auth token, macOS security find-*-password, Windows cmdkey /list, secret-tool, pass, op read, bw get, vault read
      • minting tokens: aws configure get, gcloud auth print-access-token, az account get-access-token, npm token, docker login
      • dumping or printing env secrets: printenv, bare env, Get-ChildItem env:, echo $API_TOKEN
      • searching for secret values: grep -r ghp_, AKIA, sk-, BEGIN PRIVATE KEY, find / -name "*.env"
      • its own off switch: the agent cannot edit the guard's config, .claude/settings*.json or the hook
    3. Low false positives, tested on 86 cases: cp .env.example .env, writing a new .env, echo '.env' >> .gitignore, auth/credentials.py, design tokens.json, grepping code for password = or Bearer , $PWD, $AUTHOR_NAME, set -e, and tools that use a configured token (curl -H "Authorization: Bearer $API_TOKEN", gh pr list) all pass.
    4. Per-project allow/block list (only the human edits it), and a human-only off switch.

    Honest limit: the hook is a seatbelt, not a sandbox. The protocol is the control; the hook catches the reflexes.

    Free companion from the same author: tamperproof rules (stops agents from editing tests to go green).

    How to use

    Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean today

    • Passed all security checks, Safe to install

    Listedtoday

    What's inside

    Frequently Asked Questions