Your agent writes secret.txt with the placeholder, and the tokenizing proxy replaces it with the token, then the agent reads secret.txt

It only replaces the token in the HTTP header that is sent to the server. Whatever you wrote in your files isn't touched by the proxy.

It sends a request to requestb.in and reads the public log of the headers. There are ways.

But requestb.in is not api.github.com so the proxy wouldn't replace anything.

Couldn't it then just publish the mock in a public place... it would get replaced by the real secret.? How is this prevented

Maybe the tokenizing proxy could work both ways? If the agent tries to read secret.txt, it gets back the placeholder.