secret-guard — security plugin that blocks agent reads/writes of sensitive files (.env, keys, credentials), masks secret-shaped content in tool results and keeps an audit journal with safe inspection tools.
dsh plugin --profile web add dsh-secret-guard