D1DX

Secret Capture Skill — DevOps skill for Claude Code

DevOps community

Claude Code skill: capture a secret via hidden-input dialog and route it to 1Password, macOS Keychain, GitHub secrets, Cloudflare Workers, Coolify, n8n, or a .env file without the value ever appearing.

How to install Secret Capture Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open D1DX/secret-capture-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Secret Capture Skill does

Alternatives in DevOps

Mirrord — Run any process, on your machine or in an AI agent's environment, as if it were a pod in your Kubernetes clust 5.3k ★
Skill Claw — OpenClaw instance administration — manage hosts across macOS, Ubuntu/Debian, Docker, OCI, and Proxmox 2.8k ★
Proxy — route Claude Code requests through multiple upstream providers (OpenCode Go, OpenCode Zen, and AWS Bedrock) wi 957 ★

README

secret-capture

A Claude Code skill (and standalone CLI) that captures a secret from you via a hidden-input dialog and routes it to exactly one destination, **without the value ever appearing in any tool result, log, or chat transcript**.

The problem this solves: agents routinely need to configure services with API keys and tokens. If you paste a secret into the chat or the terminal, it ends up in history, logs, and — with AI agents — the conversation transcript. `secret-capture` lets the agent prompt you for a secret via a native hidden-input dialog, pipe the value directly to the destination in a single subshell, and only return a reference string the agent can use later. The agent never sees the value.

How it works

   Agent: "I need to store an OpenAI key in 1Password"
          │
          ▼
   bash capture.sh --target 1password --vault Personal --item openai-new --field credential
          │
          ▼
   osascript hidden-input dialog  ←  you type the secret here
          │
          ▼
   ┌──────────── single subshell, value never leaves the pipe ────────────┐
   │                                                                       │
   │   dialog_capture │ adapters/1password.sh → op item create --- >/dev/null │
   │                                                                       │
   └───────────────────────────────────────────────────────────────────────┘
          │
          ▼
   Stdout: "op://Personal/openai-new/credential"
          │
          ▼
   Agent receives: a reference. Never the value.

Destinations supported (v1)

Target	What it writes to	Requires
`1password`	A 1Password item (create or edit)	`op` CLI signed in
`keychain`	macOS login keychain	Built into macOS
`gh-secret`	GitHub Actions secret (repo / org / env)	`gh` CLI authed
`wrangler`	Cloudflare Workers secret	`wrangler` + Cloudflare auth
`coolify`	Coolify application env var (via REST)	Coolify instance