Secrets Scan

Prompt contract

Treat $ARGUMENTS as a free-form RU/EN prompt. Modes/flags may appear anywhere; infer mode and scope from prose.

Mode	EN keywords	RU keywords	Mutates?
`scan`	(empty), scan, check, audit, find	скан, проверь, аудит, найди	no
`fix`	fix, remediate, clean up, `--fix`	почини, исправь, зафикси	yes

Explicit --fix resolves to fix before stripping flags. An explicit mode token anywhere wins outright.
Else score modes by distinct whole-word keyword hits (table above). Highest unique score wins; tie -> scan (read-only wins). All zero -> scan.
Empty arguments -> scan; ask no routing question. The Phase 6 findings-triage offer requires approval before any remediation.
fix is also auto-offered (not auto-run) whenever CRITICAL/HIGH findings exist, per Phase 6 — that offer is the outcome-changing AskUserQuestion, not a second resolution pass.
Prose that is not a mode/flag is still input: treat it as scope narrowing (e.g. "scan the api folder") if the skill supports it, otherwise ignore for routing and scan the full repo.