# Secret Guard

> How to handle {{S_xxxxxxxx}} secret placeholders. Use when a prompt or file contains a {{S_...}} token, or when the user asks to store, place, or use an API key, token, or password that was redacted.

- Skill: `kimsb2429/secret-guard` (Agent Skill, multi-file: 10 files)
- Install (CLI): `npx skillmds@latest add kimsb2429/secret-guard`
- Raw SKILL.md: https://api.skillmd.com/api/skills/kimsb2429/secret-guard/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: kimsb2429 (https://skillmd.com/u/kimsb2429)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/kimsb2429/secret-guard

---


# secret-guard placeholders

A token shaped `{{S_xxxxxxxx}}` is a redacted credential. The real value never enters this conversation. The plugin holds it in memory for this session; once written to a `.env` file in the project it also resolves in later sessions (the id is a hash of the value).

Rules:
- Use the placeholder verbatim wherever the real value belongs: `.env` lines, `export` statements, `curl -H` headers, config files. The secret-guard plugin swaps in the real value when the tool runs.
- Never ask the user to paste the secret again. Never try to read it via `cat`, `env`, or any other route; tool output is scrubbed and will only show the placeholder.
- When placing a key, prefer `.env` in the project root (create it if missing, add it to `.gitignore`), keyed by the provider name the placeholder context gives (e.g. `ANTHROPIC_API_KEY`).
- A placeholder from a past session resolves only if the value sits in `.env`, `.env.local`, `.env.development`, `.env.production`, or `.env.test` in the working directory. If substitution fails, tell the user the key must be pasted again.