secret-warn

# secret-warn — real-time edit-time security guardrails Catches secrets and unsafe patterns the moment a Claude Code agent writes them, not after the fact. Public substrate version (MIT). Free to install, free to extend. ## What it does | Trigger | Severity | Action | |---|---|---| | API key in file (Stripe, AWS, GCP, OpenAI, Anthropic, GitHub, Slack) | block (exit 2) | Edit rejected | | PEM-encoded private key block | block | Edit rejected | | High-entropy assignment to a key-named variable | warn (exit 1) | Advisory, edit proceeds | | Python dynamic-codegen on a user-input-suggesting name | warn | Advisory | | Subprocess with shell-mode + variable expansion | warn | Advisory | | Curl/wget pipe-to-shell from a non-allowlisted host | block | Edit rejected | | Prompt-injection cue in *audited third-party content* (ignore-previous, role-override, exfil, system-impersonation, paste-and-run) | warn (flag-before-read) | Specimen flag via `audited_content_scan.py` — never an edit-time block | All patterns are stored base64-encoded in `hooks/pattern_registry.json` so the registry file itself doesn't trip pattern-matching tools that scan the repo. This is intentional — see [Design note: self-trigger safety](#design-note-self-trigger-safety) below. ## Install ```bash bash skills/secret-warn/install.sh ``` The installer: - Copies `hooks/secret_warn.py` + `hooks/audited_content_scan.py` to `~/.claude/secret-warn/` - Copies `hooks/pattern_registry.json` to the same location - Merg...