agentwhy-session-audit

by buildwithclaude

Checks which private files (.env, keys, secrets) Claude Code and its subagents reached in this project, whether a value came into an agent's context, and which key to change, by running the open source agentwhy CLI over the session records Claude Code already keeps on disk. Use when the user asks whether the agent or a subagent read their .env or other secrets, which private files a session touched, whether a key leaked into the conversation, or which key to rotate. Runs locally and never prints a secret value.

v1.0.0New

#buildwithclaude

Unsigned, install at your own risk

Unverified

This skill has no cryptographic signature attached. We can't verify the contents match what the publisher intended.

Install this skill

Run this command in your terminal. No account required — it auto-detects your AI tool and installs the skill file.

npx @skills-hub-ai/cli install buildwithclaude-agentwhy-session-audit

Or download directly:

Browse all CLI commands →

Setup by platform

Claude Code

~/.claude/skills/<skill>/SKILL.md

Setup guide →

Install

One-click setup for your editor

Run in your project root

npx @skills-hub-ai/cli install buildwithclaude-agentwhy-session-audit --target claude-code

Instructions

This skill doesn’t include stateful context yet, instructions only. Learn about stateful skills.

Security

Loading security scan...

Reviews (0)

View full changelog & diffs →

Browse all →

telegram-automationAutomate Telegram tasks via Rube MCP (Composio): send messages, manage chats, share photos/documents, and handle bot commands. Always search tools first for current schemas.1 installs project-milestone-tracker项目管理里程碑跟踪器（Project Milestone Tracker）——当用户要求代理在代码库/项目会话中规划、跟踪里程碑、记录承诺或事件、生成进度报告时使用。核心：三层里程碑规则（文件依据/客户提供/待确认）+ 原话+时间戳事件记录。Project milestone tracker: plan and track project milestones, record events with original text + timestamp, generate status reports, using a three-tier milestone rule (contract-sourced / stakeholder-stated / pending-confirmation).1 installs render-automationAutomate Render tasks via Rube MCP (Composio): services, deployments, projects. Always search tools first for current schemas.1 installs x-twitter-scraperX (Twitter) data extraction and monitoring via Xquik: tweet search, user lookup, follower extraction, giveaway draws, trending topics, account monitoring with webhooks, reply/retweet/quote extraction, community and Space data, follow checks. 22 MCP tools + REST API.1 installs notion-automationAutomate Notion tasks via Rube MCP (Composio): pages, databases, blocks, comments, users. Always search tools first for current schemas.1 installs ops-ecomShopify store command center. Orders, inventory, fulfillment, analytics, and store health. Works with any Shopify store via Admin API.1 installs

More from buildwithclaude

View source →

json-canvasCreate and edit JSON Canvas files (.canvas) with nodes, edges, groups, and connections. Use when working with .canvas files, creating visual canvases, mind maps, flowcharts, or when the user mentions Canvas files in Obsidian.3 installs ecommerce-material-studio电商素材工坊（中英双语）。用户需要生成电商主图、详情图、场景图、产品图合成、品牌叠加时使用。自动识别品类→匹配风格→场景感知合成→统一文字→自动质检→多平台适配→标准化交付。E-commerce product image studio: category detection, style matching, scene-aware compositing, text overlay, quality check, multi-platform adaptation, batch delivery.3 installs code-healthScans the codebase for dead code, tech debt, outdated dependencies, and code quality issues. Delegates to the Centinela (QA) agent.2 installs cf-proxyDeploy a free VLESS proxy/VPN node on Cloudflare Pages using edgetunnel. Automates code download, UUID generation, Pages deployment, free domain registration (DNSExit), DNS configuration, custom domain binding, and client setup for Shadowrocket/v2rayN/Clash. Uses Cloudflare Pages (not Workers) because Pages supports CNAME-based custom domains from any DNS provider, avoiding the need to host DNS on Cloudflare.2 installs dating-profile-coachReview and improve a dating profile on Tinder, Hinge or Bumble — rank the user's photos and pick the lead photo, check them against the app's official photo and AI-photo rules, then tighten the bio and suggest openers. Use when the user asks "which photo should be my first", "rate my dating photos", "can I use AI photos on Hinge/Bumble/Tinder", "fix my dating profile", or shares profile photos or a bio for feedback. Uses the free DatePhotos.AI MCP for official rules and photo scores when connected; falls back to a built-in checklist when it is not.1 installs ops-commsSend and read messages across all channels. Routes based on arguments — whatsapp, email, slack, telegram, discord, notion, or natural language like "send [msg] to [contact]".1 installs

More Security skills

Browse category →

secureFull-stack security posture assessment with 0-100 risk scoring. Scans dependency vulnerabilities (npm audit, pip-audit, cargo audit, govulncheck), dangerous code patterns (SQL injection, eval, command injection, ReDoS, innerHTML, XSS vectors), authentication gaps (missing auth middleware.19 installs pentestStatic-analysis penetration test that hunts for exploitable vulnerabilities with proof-of-concept payloads and fix code.17 installs owaspSystematic audit against the OWASP 2021 Top 10 web application security risks with severity-rated, file-level findings.14 installs check-vantaFetches dependency vulnerabilities from Vanta, Snyk, Dependabot, or GitHub Security Advisories, creates a tracking issue in Jira/Linear/GitHub Issues, then fixes, commits, pushes, and opens PRs for each affected repo. Trigger on: vulnerabilities, security scan, Vanta, CVE, dependency audit, Snyk, Dependabot.5 installs hipaaDeep HIPAA Security Rule technical audit mapping code-level findings to 45 CFR sections. Triggers: building or auditing healthcare apps, EHR integrations, FHIR APIs, telehealth platforms.5 installs gdprGDPR and CCPA/CPRA privacy compliance audit for codebases. Inventories PII fields (email, phone, SSN, IP, device ID, geolocation, biometrics, behavioral data), maps data collection points (forms, APIs, cookies, analytics, error tracking), audits consent mechanisms (cookie banners, opt-in.5 installs

Frequently asked questions about agentwhy-session-audit

What does the agentwhy-session-audit skill do?

How do I install the agentwhy-session-audit skill?

Run `npx @skills-hub-ai/cli install buildwithclaude-agentwhy-session-audit` from your terminal. The CLI writes the SKILL.md to the correct location for your AI tool (e.g. ~/.claude/skills/buildwithclaude-agentwhy-session-audit/ for Claude Code or ~/.cursor/skills/ for Cursor with --target cursor) and adds it to your project's .skills.json lockfile.

Which AI tools does agentwhy-session-audit work with?

agentwhy-session-audit runs in Claude Code. It follows the open Agent Skills standard (SKILL.md), so the same skill works in every supported tool without modification.

Is the agentwhy-session-audit skill free?

Yes. Every skill on skills-hub.ai is free and open-source. There are no premium tiers, paywalls, or usage limits. You only pay for whatever AI assistant you're already using.

How do I use agentwhy-session-audit after installing it?

In Claude Code, type `/buildwithclaude-agentwhy-session-audit` (or whatever slash command the skill registers) and the AI follows the skill's instructions immediately. You can also reference it by name in natural language, your AI loads the skill into context when relevant.

Can I share the agentwhy-session-audit skill with my team?

Yes. Commit your project's .skills.json lockfile and teammates run `npx @skills-hub-ai/cli install` (no args) to install every skill at the exact version you pinned. Organization-scoped installs work via skills-hub.ai organizations.