skills.rest
hanabi-jpn
hanabi-jpnCOMMUNITY
Explore all skills by this author →
GitHub

credential-vault

Manage API key storage, rotation, and leak detection via macOS Keychain.

3|2|Updated Mar 1, 2026
Search Tags:#encryption#macos#api keys#leak detection#credential management#keychain
One-click install
npx skills add https://github.com/hanabi-jpn/clawhub-skills --skill credential-vault-hanabi-jpn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: credential-vault
Source: https://github.com/hanabi-jpn/clawhub-skills/tree/main/security-devops-pack/credential-vault
Command: npx skills add https://github.com/hanabi-jpn/clawhub-skills --skill credential-vault-hanabi-jpn

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) and references (resource) components.

What problem does it solve?

This Skill addresses the critical issue of secure API key and secret management for developers using Claude Code on macOS, ensuring that credentials are never stored as plaintext and are protected against leaks and exposure.

Core Features & Use Cases

  • Secure Storage: Encrypts API keys and secrets using AES-256-GCM and stores them in a dedicated macOS Keychain.
  • Keychain Integration: Utilizes macOS Keychain as the single source of truth, ensuring credentials are securely stored and accessible.
  • Zero-Plaintext Operation: Ensures that credentials are never written to disk in plaintext, mitigating the risk of leaks.
  • Leak Detection: Continuously scans for leaked credentials in various surfaces like logs, clipboard, and git history.
  • Rotation Policies: Enforces key age and rotation policies to maintain security posture.
  • Project Isolation: Keeps credentials isolated per project to prevent lateral movement and cross-contamination.

Quick Start

Store a new API key for a project using Credential Vault: vault store ANTHROPIC_API_KEY --project my-app

Frequently Asked Questions about credential-vault

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I store API keys securely on macOS without writing plaintext to disk?▼

To store API keys securely on macOS without plaintext exposure, use the macOS Keychain integrated with AES-256-GCM encryption. This ensures credentials are encrypted and managed via the `security` command-line tool, preventing any plaintext from being written to disk.

How does credential leak detection work for Claude Code workflows?▼

Credential leak detection works by continuously scanning surfaces like logs, clipboard, and git history for exposed API keys. This automated process identifies secrets that have inadvertently leaked, allowing developers to rotate or revoke them before they are exploited.

Can I isolate API keys per project using macOS Keychain?▼

Yes, you can isolate API keys per project using macOS Keychain. This Skill supports project isolation to prevent lateral movement and cross-contamination, ensuring that credentials for one project remain inaccessible from others.

What is the best way to enforce API key rotation policies for Claude Code?▼

The best way to enforce API key rotation policies is to use a credential management system that tracks key age. This Skill enforces rotation policies automatically, maintaining your security posture by requiring updates when keys exceed their maximum age.

Does credential management with macOS Keychain require any specific command-line tools?▼

Yes, credential management with macOS Keychain requires the `security` command-line tool for Keychain access. This native macOS utility is used as the single source of truth to securely store and retrieve your encrypted API keys.

How do I retrieve a stored secret from the credential vault during development?▼

To retrieve a stored secret, you use the credential vault's retrieval function which fetches the encrypted key from macOS Keychain. This allows zero-plaintext operation by decrypting the secret only in memory when your application needs it.

Related Skills

Explore More Software Engineering Skills→
DevelopersCoffeeDevelopersCoffee
3

cwe-311-non-encrypted-storage

Remediate CWE-311 vulnerabilities in Java code with AES-256-GCM encryption.

Official
Intermediate
arbazkhan971arbazkhan971
26

secrets

Detect exposed secrets and rotate credentials into secret managers.

Community
Advanced
alibabaalibaba
2.2k

security-check

Scan Git diffs for sensitive credentials before commit or push.

Official
Intermediate
plurigridplurigrid
60

keychain-secure

Store and retrieve credentials in macOS Keychain with GF(3) lifecycle enforcement.

Official
Advanced