royashbrook

Hush — AI skill for Claude Code

AI community

a secret store for ai agents with one rule: the agent never sees the plaintext.

How to install Hush

This entry records only its repository, not the path inside it, so there is no exact command to give. Open royashbrook/hush and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Hush does

a secret store for ai agents with one rule: the agent never sees the plaintext. get a secret once into the os keychain, then inject it into commands forever. no get, cross-platform, mit

Alternatives in AI

  • Hol Guard — Open-source antivirus for AI agents: block risky tools, secret access, prompt injection, malicious packages, M 485 ★
  • Prismor — Self-hosted runtime control plane for AI agents 334 ★
  • Kru — Local-first MCP password and credential manager for AI agents 125 ★

README

hush

a secret store for AI agents, the one with no get.

CI MIT cross-platform no get

get a secret once into the OS keychain, then inject it into commands forever, the value never hits stdout, the transcript, or the cloud.


A secret store for AI agents, with one hard rule: **the agent never sees the plaintext.**

Values never reach stdout, so they never land in the tool result, the transcript, or the cloud. A secret only ever moves from the store straight into the consumer. There's no `get` on purpose, a plain getter is the leak.

The point: you (an agent) are running as the user with their CLIs already authed, so you can already set a server-side secret or call a service, you just can't *see* the value without it landing in the chat. hush gets it once into the OS keychain, then you inject it into those commands forever. No chat paste, no temp files, no `.env` to commit by accident.

agents: start here

**If you were handed this repo's url, install yourself, then follow the playbook.** Get the `hush` script onto the box and read [`SKILL.md`](SKILL.md), that's the whole onboarding (it covers store / mint / inject and how to adopt hush in the repo you're working in). The script is one self-contained bash file; put it wherever y