Bagman Skill

Bagman

Secure key management patterns for AI agents handling wallets, private keys, and secrets.

**Bagman** solves the three critical problems of agentic key management:

1. Key Loss — Agents forget credentials between sessions
2. Accidental Exposure — Keys leaked to GitHub, logs, or outputs
3. Prompt Injection — Malicious prompts extracting secrets

Quick Start

Choose Your Backend

Bagman supports multiple secret storage backends. **No 1Password required.**

Backend	Setup	Best For
macOS Keychain	None (native)	macOS users, zero setup
1Password CLI	brew install 1password-cli	Teams, rich metadata
Encrypted File	brew install age	Portable, git-friendly
Environment Vars	None	CI/CD, containers

Bagman auto-detects the best available backend.

Install

# Clone
git clone https://github.com/zscole/bagman-skill.git
cd bagman-skill

# Optional: Install backend dependencies
brew install age          # For encrypted file backend
brew install 1password-cli  # For 1Password backend

Usage

from examples.secret_manager import get_secret, get_session_key

# Auto-detects backend
api_key = get_secret("openai-key")

# With session metadata
creds = get_session_key("trading-bot")
if creds.is_expired():
    raise ValueError("Session expired")
    
print(f"Backend: {creds.backend}")
print(f"Expires: {creds.time_remaining()}")

Force Specific Backend

from examples.backends import get_backend

# Force macOS Keychain
backend = get_backend("keychain")

# Force 1Password
backend = get_backend("1password", vault="My-Vault")

# Force encrypted file
backend = get_backend("encrypted_file", path="~/.secrets.age")

# Force environment variables
backend = get_backend("env")

Or via environment variable:

export BAGMAN_BACKEND=keychain

---

Backends

macOS Keychain (Default on macOS)

Zero setup required. Uses native `