hamdok

Aestheris — Security skill for Claude Code

Security community

Let your AI agents act without handing them your keys or your data.

How to install Aestheris

This entry records only its repository, not the path inside it, so there is no exact command to give. Open hamdok/aestheris and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Aestheris does

Let your AI agents act without handing them your keys or your data. Local, open-source trust layer: vault & phantom tokens, sandbox, provider-side pseudonymization, human approval, audit log.

Alternatives in Security

Security Threat Model — Generate repo-specific threat models identifying trust boundaries 14.6k ★
Om Vault Audit — Vault Audit 4.6k ★
Azure Key Vault .net — Cryptographic key management 1.8k ★

README

Aestheris

**Let your AI agents act — without handing them your keys or your data.**

[Français](README.fr.md) · [Security policy](SECURITY.md) · [License: Apache-2.0](LICENSE)

Aestheris is an open-source trust layer that runs **on your machine**, between AI agents (Claude Code, Codex, any agent that honors a base URL) and the outside world (LLM providers, APIs):

┌ sandbox ─────┐
│    agent     │──(phantom token)──▶ Aestheris 127.0.0.1 ──(real key)──────▶ api.stripe.com
└──────────────┘                      │ policy · human approval · audit log
 ~/.ssh, ~/.aws, .env: unreadable     │ privacy shield ──([EMAIL_1], [CLIENT_2])──▶ LLM provider

Agents never hold real secrets. They get a phantom token; the gateway injects the real key, from an encrypted local vault, on the way out.
Your AI provider never learns who your customers are. Emails, phone numbers, IBANs, card numbers, client and project names, and your machine identity are replaced with typed pseudonyms ([EMAIL_1], [CLIENT_2]) before a request leaves, and restored locally in the response — including streamed tool calls. The agent still works on real data.
Real values only go where your policy allows ("phantom data"): an agent hijacked by a prompt injection can only exfiltrate pseudonyms.
The agent runs in a sandbox (macOS Seatbelt, Linux bubblewrap + seccomp): no ~/.ssh, ~/.aws, .env, browser profiles, Docker socket or direct network.
Risky actions wait for a human (aestheris approve), every request goes to a hash-chained audit log, and an observe mode measures what would have been blocked before you enforce it.

Try it

curl -fsSL https://raw.githubusercontent.com/hamdok/aestheris/main/install.sh | sh
cd your-project
aestheris scan            # 5 seconds, no setup: what your agents can read or leak
aestheris init            # encrypted vault + ready-made policy (Claude Code, OpenAI, GitHub, Stripe)
aestheris run -- claude