Read-only agent-fleet credential hygiene audit: credential-file permissions, embedded credentials in git remotes (masked in output), and provider token literal counts; zero-dependency and deterministic.
dsh plugin --profile web add github:LeslieWylie/dsh-fleet-audit