agentleFS
Sign inStart free
Slava-codeSlava-code/college-kb/.claude/skills/kb-secrets/SKILL.md

kb-secrets

Skill0 starsChanged 30 days agoMITView on GitHub

Use when the student asks about passwords, API keys, tokens, an LMS token, a password manager or its CLI, .env files, "where is my X key", or a command that needs a secret; pointer-first lookup, then a minimal, never-printed vault fetch.

  • Reads credentials

The file

We split this skill into the rules it gives an agent

2 rules. About 0 are common, 0 are distinctive, and 2 are very specific to this project.

  • ≈0

    Common · estimate

    Many files like this have a rule of this kind.

  • ≈0

    Distinctive · estimate

    This author's own choices. Worth a look.

  • 2

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  • could be automatic: a setting could enforce it
  1. Very specific:

    Never: write a secret value anywhere: not in pages, drops, commit messages, chat, prompts, shell profiles, or command output you echo.

    line 10
  2. Very specific:

    New secret?: Add only a pointer entry to secrets/README.md using its template, and commit schema: update secrets-pointers.

    line 15

≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

kb-secrets

AGENTS.md is canonical (§Security); this is only a thin task pointer. Policy and pointer format: secrets/README.md.

  1. Never write a secret value anywhere: not in pages, drops, commit messages, chat, prompts, shell profiles, or command output you echo. That includes masked or partial values, recovery codes, private keys, OAuth tokens, session tokens and .env contents.
  2. Pointer first. For "where is X / what holds X", answer from secrets/README.md (vault item name, where it is used). If a pointer answers the question, do not touch the vault.
  3. Vault only on request. Use the password manager only after the student asks for a secret-dependent action in this session. They unlock it in their own terminal (for example bw unlock, op signin, or the desktop app's CLI integration) before starting the session; never ask them to paste a master password or session token into chat.
  4. Minimum, piped, not printed. Fetch the one field needed and hand it straight to the one command that needs it, for example SOME_TOKEN="$(<vault-cli> get <field> '<item name>')" <command>, or the manager's own injection feature (such as op run --env-file). Never echo it, never print full item JSON, never write it to a file in the repo.
  5. Lock when done (bw lock, op signout, or the equivalent) and remind the student to clear any exported session variable in their shell.
  6. New secret? Add only a pointer entry to secrets/README.md using its template, and commit schema: update secrets-pointers.
  7. Leak found (in the repo, a drop, or tool output): stop, tell the student to rotate or revoke it now, and record only a pointer plus a short incident note. Removing it from git history is a separate, deliberate step the student approves.
  8. Maintenance runs (kb-triage, kb-garden) never depend on an unlocked vault.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free