More screenshots
Works with the AI Agents you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsCode Security Engineer
Help your coding agent check secret exposure, private data access, and security fixes before release.
$5
Code Security Engineer
Example session with this skill installed
Use the packaged sensitive-data checker on a temporary Git repository with randomly generated fake GitHub and Google key patterns plus a fake client secret. Show the complete output. Replace those values with explicit placeholders and repeat the check. Verify the categories, line numbers, exit codes, and omission of token values from checker output. Use no real credentials or provider calls.
- Read your context and instructions
- Compiled the code security engineer
Observed synthetic demonstration
A temporary Git repository contained one four-line JavaScript file. Its three credential-like values were random synthetic data. No real credentials or provider calls were used. The checker came from code-security-engineer.zip.
| Stage | Actual checker result | Exit code |
|---|---|---|
| Before | github-token at line 2; google-api-key at line 3; secret-assignment at line 4 | 1 |
| After | Zero findings after explicit placeholders replaced all three values | 0 |
Command
node installed/code-security-engineer/scripts/sensitive-check.mjs demo/app.js
The installed path belongs to the temporary demonstration. From your installed skill folder, use:
node scripts/sensitive-check.mjs /path/to/selected-source.js
Independent assertions about output
Local assertions checked the exact three rule names and line numbers. They also checked that no fake token values appeared in the checker JSON. After replacement, assertions checked an empty findings array and exit code 0. Both assertion groups passed. These were programmatic checks, not a separate agent security review.
Screenshot source
The attached Before and After images are direct Chrome screenshots of a live local browser harness. On each request, the harness ran the packaged checker and displayed the complete process output, source listing, exit code, and assertion results. The source listing deliberately shows only fake values. The checker JSON omits those values. No output lines were selected or invented. These are browser harness screenshots, not terminal screenshots.
Limits
This demonstrates three static secret patterns and placeholder handling. It does not test a customer application, prove a credential is active, or verify runtime exploit protection. Pattern checks can miss encoded values, custom secrets, and personal data. A zero-match result does not establish application safety.
Connects securely to your tools. The creator never sees your data.
About this skill
Protect keys and private data before release
AI-built apps can expose server keys in browser code, print private data in logs, or let one user access another user's records. Code Security Engineer gives your coding agent a structured process to review these risks.
What you receive
- Three modes: focused review, repository audit, and security fix verification.
- Nine reference guides for sensitive data, web access, agent tools, dependencies, cloud services, native code, execution controls, and reports.
- Three dependency-free Node.js tools for secret patterns, report validation, and Markdown output.
- A JSON report example, original MIT license, upstream attribution, and warranty limits.
How it works
- Select the source and review scope.
- Trace inputs, permissions, and sensitive data destinations.
- Check selected files for common secret patterns without printing matched values.
- Require a bounded local result and independent review before a confirmed finding.
- Record unresolved concerns, next checks, and coverage gaps.
The checker flags suspected secrets. Your agent must redact evidence; the tool does not automatically remove secrets.
Setup and limits
The local tools require Node.js 18 or newer. The host agent supplies file access, independent review, and enforced execution isolation. No account or CLI login is required by the supplied tools.
The package includes no sandbox launcher, background service, interception hook, or vulnerability scanner. Its scripts make no network calls and execute no target code. It cannot guarantee zero leaks or complete security coverage.
The local helper tests passed during release verification. These checks establish tested helper behavior, not the security of a buyer's application.
License and warranty
This original implementation draws inspiration from Cloudflare's MIT-licensed audit workflow. The package includes attribution and the upstream license notice. Cloudflare does not endorse it.
Provided as is to the extent permitted by law. Mandatory legal rights remain unaffected. Read DISCLAIMER.md before use.
How to use
Skills on Agensi run inside your AI agent. Copy the prompt, paste it into your agent, and it connects to Agensi and installs this skill for you. If a payment is needed, your agent shows it to you first.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
Money-back guarantee
Doesn't do what its page promises? You get your money back.
Trust & safety
Security scanned
Verified clean 8 days ago
- Passed all security checks, Safe to install
Requires
Node.js