Secretctl — AI skill for Claude Code

secretctl

**Stop pasting API keys into AI chat.**

When you paste `sk-proj-xxx` into Claude Code, that secret is now in your conversation history, Anthropic's logs, and potentially exposed to prompt injection attacks.

secretctl fixes this. Your AI gets command results, never secret values.

[](https://go.dev/) [](LICENSE) [](https://forest6511.github.io/secretctl/) [](https://codecov.io/gh/forest6511/secretctl)


---

The Problem

Every day, developers paste secrets into AI coding assistants:

You: "Help me debug this AWS error"
You: "Here's my config: AWS_ACCESS_KEY_ID=AKIA..."

**This is a security incident waiting to happen.**

• Secrets in conversation history
• Secrets in cloud logs
• Secrets exposed to prompt injection
• No way to rotate or revoke

The Solution

secretctl injects secrets as environment variables. Your AI runs commands and sees results, but **never sees the actual credentials**.

• Single binary — No servers, no configuration, no subscription
• Local-first — Secrets never leave your machine
• MCP integration — Works with Claude Code out of the box
• Defense in depth — AES-256-GCM + Argon2id + output sanitization

# That's it. You're done.
secretctl init
secretctl set API_KEY
secretctl get API_KEY

Why Local-First & AI-Safe?

1. Your secrets, your machine — No cloud sync, no third-party servers, no subscription fees. Your credentials stay