Opensecretmask — AI skill for Claude Code

osm

**Keep your API keys out of the model, without breaking what the model can do.**

A [Claude Code](https://claude.com/claude-code) plugin. It swaps every secret for a format-preserving fake before Claude reads it, and puts the real value back on the way into a tool call.


A real session, not a mock-up: the plugin is installed, a file holding `sk-ant-api03-Kv8Tz2…` is written and `cat`-ed, and the model answers with a *different* 74-character key of the same shape. `/osm-secrets` prints the pair. Recorded by [`scripts/record-demo.sh`](scripts/record-demo.sh).

flowchart LR
    ENV[".env / tool output
sk-ant-api03-Kv8Tz2…"]
    MASK["mask"]
    MODEL["Claude
sk-ant-bpc23-VpONd6…"]
    REST["restore"]
    SHELL["your shell
sk-ant-api03-Kv8Tz2…"]
    VAULT[("vault
fake ⇄ real")]

    ENV --> MASK --> MODEL --> REST --> SHELL
    MASK -.-> VAULT
    VAULT -.-> REST

    classDef real fill:#1f6f43,stroke:#2ea16a,color:#fff
    classDef fake fill:#7a4b16,stroke:#c98a3a,color:#fff
    class ENV,SHELL real
    class MODEL fake

Why a fake and not `[REDACTED]`

A fake keeps the vendor prefix, the length and the character classes of the real value: `sk-ant-api03-Xk9…` becomes `sk-ant-nvd59-RAT…`.

`[REDACTED]` tells the model something is *missing* — it stops treating the value as an Anthropic key and starts treating it as a hole. A same-shaped fake preserves the plan, so the model writes the command it would have written anyway. This is the whole point of the project.

Install

Needs Claude Code **2.1.272+**. Function hooks are early-access, so the flag is required.

claude plugin marketplace add pratikbin/opensecretmask
claude plugin install osm@opensecretmask

CLAUDE_CODE_ENABLE_FUNCTION_HOOKS=1 claude

Running from a clone (for working on the plugin itself)