credential-vault

Name: credential-vault
Availability: InStock
Author: traygerbig

Manage API keys and secrets in macOS Keychain for Claude Code.

1|Updated Mar 13, 2026

Search Tags:#leak detection #credential management #key rotation #API key storage #macOS Keychain

Ready to run

npx skills add https://github.com/traygerbig/clawhub-skills --skill credential-vault

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: credential-vault
Source: https://github.com/traygerbig/clawhub-skills/tree/main/security-devops-pack/credential-vault
Command: npx skills add https://github.com/traygerbig/clawhub-skills --skill credential-vault

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires security, git-secrets, and includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the security risks associated with storing API keys and secrets in plaintext, providing a secure and efficient way to manage credentials for Claude Code on macOS.

Core Features & Use Cases

Secure Storage: Encrypts API keys and secrets using AES-256-GCM and stores them in a dedicated macOS Keychain.
Key Rotation: Automates key rotation for supported services and provides warnings for keys nearing rotation deadlines.
Leak Detection: Continuously scans for credential leaks in log files, terminal output, and clipboard contents.
Multi-Project Isolation: Ensures that credentials are isolated per project to prevent cross-contamination.
Integration: Integrates with git-secrets for pre-commit protection and with mac-sentinel for runtime protection.

Quick Start

Use the credential-vault skill to store a new API key for your project.

Frequently Asked Questions about credential-vault

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I store API keys securely without plaintext exposure on macOS?▼

To store API keys securely without plaintext exposure on macOS, you can use a credential vault that encrypts secrets with AES-256-GCM and saves them directly into the macOS Keychain.

What is the best way to prevent credential leaks in git commits?▼

Preventing credential leaks in git commits is best achieved by integrating a credential vault with git-secrets, which automatically scans and blocks sensitive data from entering your repository pre-commit.

Does credential management with macOS Keychain require specific dependencies?▼

Credential management with macOS Keychain requires the `security` command-line tool for Keychain access and `git-secrets` to enforce pre-commit protection against accidental secret leaks.

Can I isolate API keys per project to prevent cross-contamination?▼

Yes, you can isolate API keys per project to prevent cross-contamination by using a credential vault that enforces multi-project isolation, ensuring secrets remain strictly separated.

How does automated key rotation work for stored secrets?▼

Automated key rotation works by periodically updating supported service credentials and actively warning developers when stored secrets are nearing their rotation deadlines.

What limitations exist when scanning for credential leaks in terminal output?▼

Scanning for credential leaks in terminal output and log files is limited to continuous monitoring within the local environment, relying on runtime protection integrations to detect exposures.