Agentwhy Session Audit
Agentwhy Session Audit is an agent skill (a SKILL.md file) from davepoon/buildwithclaude. Checks which private files (.env, keys, secrets) Claude Code and its subagents reached in this project, whether a value came into an agent's context, and which key to change… It works with Claude Code and has 3,679 GitHub stars across a repository of 3 listed skills.
Data as of from the GitHub API; description from the skill's SKILL.md. Report an error
- Multi-skill repo
- Plugin marketplace
- Security
- Maintained
Add this skill
Claude
This repository is a Claude Code plugin marketplace. In Claude Code:
/plugin marketplace add davepoon/buildwithclaude
/plugin install all-skills@buildwithclaudeIn the Claude apps, zip the agentwhy-session-audit folder and upload it under Customize > Skills > + > Upload a skill (code execution must be on).
ChatGPT / Codex
Codex reads skills from .agents/skills/ in a repo or ~/.agents/skills/ for every project:
git clone --depth 1 https://github.com/davepoon/buildwithclaude.git
cp -r buildwithclaude/plugins/all-skills/skills/agentwhy-session-audit .agents/skills/agentwhy-session-audit # repo; ~/.agents/skills for all projectsStandalone skills also load in the ChatGPT desktop app.
Cursor
Cursor loads skills from .cursor/skills/ (or ~/.cursor/skills/) and also reads .claude/skills/:
git clone --depth 1 https://github.com/davepoon/buildwithclaude.git
cp -r buildwithclaude/plugins/all-skills/skills/agentwhy-session-audit .cursor/skills/agentwhy-session-audit # project; ~/.cursor/skills for all projectsSource (checked Oct 7, 2026): code.claude.com/docs/en/skills (opens in a new tab), code.claude.com/docs/en/plugin-marketplaces (opens in a new tab), support.claude.com/en/articles/12512180-using-skills-in-claude (opens in a new tab), learn.chatgpt.com/docs/build-skills (opens in a new tab), cursor.com/docs/context/skills (opens in a new tab)
What this skill does
Checks which private files (.env, keys, secrets) Claude Code and its subagents reached in this project, whether a value came into an agent's context, and which key to change, by running the open source agentwhy CLI over the session records Claude Code already keeps on disk. Use when the user asks whether the agent or a subagent read their .env or other secrets, which private files a session touched, whether a key leaked into the conversation, or which key to rotate.
When it triggers
- Use when the user asks whether the agent or a subagent read their .
More skills in davepoon/buildwithclaude
3 skills are listed from this repository.
Similar skills
More security skills
Pinme R2
glitternetwork/pinme
Use when a PinMe Cloudflare Worker needs R2 object storage, including secure file or image upload, streaming download, metadata lookup, deletion, listing, Range requests, or R2+D1 coordination.
Maintained · last commit Jul 12, 2026
SecurityTypeScriptCtf Malware
ljagiello/ctf-skills
Provides malware analysis and network traffic techniques for CTF challenges.
Maintained · last commit Oct 26, 2026
SecurityPythonCriticism Self Criticism
HughYau/qiushi-skill
批评与自我批评：在工作完成、阶段验收、收到批评或同类错误反复出现时，对成果和过程做诚实、具体、基于事实的审视，输出可执行的改进项，并处理外来批评而不辩解。触发信号包括 review、复盘、审查、"帮我看看有没有问题"、"你确定吗"；任务刚开始或只是单步查询时不触发。 English: Criticism and self-criticism.
Maintained · last commit Oct 1, 2026
SecurityJavaScriptComet Review
rpamis/comet
Manually review the implementation diff for the current Comet change.
Active · last commit Oct 22, 2026
SecurityJavaScriptHunt LLM AI
elementalsouls/Claude-BugHunter
Hunt LLM/AI feature bugs — prompt injection, indirect injection, exfiltration via tool-use/markdown, ASCII smuggling, agentic AI security (OWASP Agentic Apps 2026, ASI01-ASI10).
Active · last commit Oct 25, 2026
SecurityPythonOrchestrator Container Spawn
samugit83/redamon
Spawning and hardening scan containers from the recon orchestrator: the security flags that look correct and break the container, and the sibling bind-mount path handling.
Active · last commit Oct 22, 2026
SecurityPython
How do I install the Agentwhy Session Audit skill?
In Claude Code, run /plugin marketplace add davepoon/buildwithclaude and then /plugin install all-skills@buildwithclaude. For Codex or Cursor, copy the agentwhy-session-audit folder into .agents/skills/ or .cursor/skills/.
Is the Agentwhy Session Audit skill free?
Yes. The repository is open source under the MIT license.
Is Agentwhy Session Audit maintained?
The repository's most recent commit was on Oct 26, 2026. Its latest release is bwc-cli@1.2.4. appsgit only lists skills from repositories with a commit in the last six months.