skills.rest
nbiish
nbiishCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

pqc-secrets

Encrypt and manage API keys using ML-KEM-768 post-quantum cryptography with zero plaintext on disk.

Updated Sep 2, 2026
Search Tags:#encryption#secrets management#api keys#keychain#audit log#post-quantum cryptography#ml-kem-768
One-click install
npx skills add https://github.com/nbiish/tts-mcp --skill pqc-secrets-nbiish
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: pqc-secrets
Source: https://github.com/nbiish/tts-mcp/tree/main/.agents/skills/pqc-secrets
Command: npx skills add https://github.com/nbiish/tts-mcp --skill pqc-secrets-nbiish

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires cryptography>=45, kyber-py>=0.2.0, argon2-cffi==25.1.0, and includes scripts (resource) and references (resource) components.

What problem does it solve? API keys and credentials stored in plaintext .env files, settings JSON env blocks, or shell history are exposed to backups, cloud sync, git commits, and any process with file read access. This Skill encrypts secrets at rest with FIPS 203 ML-KEM-768 and AES-256-GCM, injecting them into process memory only at runtime. ## Core Features & Use Cases - PQC-encrypted secrets bundle: A single per-machine bundle at ~/.config/pqc-secrets/secrets.bundle.json holds all API keys, encrypted via a double-envelope (ML-KEM-768 KEM, AES-256-GCM keywrap and data layers) with a passphrase-wrapped vault.pqc identity root using Argon2id and ML-DSA-65 signed audit chains. - Dual-engine CLI: A Rust binary (darwin/arm64 fast-path) and a canonical Python engine (pyca/cryptography>=45 native ML-KEM-768) provide keygen, pack, export, verify, list, rename, migrate, and vault commands with interoperable bundle JSON. - Agent and app integration: Ten browser_secrets_* MCP tools, an append-only SHA3-256-fingerprinted audit log, and integration patterns for Claude Code, VS Code, shell wrappers, CI/CD, and long-running applications like local-router. - Use Case: Wire Claude Code so settings.json contains only an empty ANTHROPIC_API_KEY placeholder, then run secrets-load before launching so the real key exists only in the OS keychain and process memory. ## Quick Start Ask the agent to generate a PQC keypair with pqc-secrets keygen, pack your API keys into the encrypted bundle, and load them into the shell with eval "$(pqc-secrets export)" before launching your tool.

Frequently Asked Questions about pqc-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I store API keys securely without .env files?▼

Pack keys into an encrypted bundle with pqc-secrets pack, which encrypts them via ML-KEM-768 and AES-256-GCM. Load them at runtime with eval "$(pqc-secrets export)" so values exist only in process memory, never in plaintext files on disk.

How to inject secrets into Claude Code settings safely?▼

Keep the env block in ~/.claude/settings.json with empty string values for keys, and inject real values at launch by running secrets-load first. The settings file references variable names only; actual values come from the encrypted bundle via process memory.

Does pqc-secrets work on Linux and Windows WSL?▼

Yes, the canonical Python engine runs on macOS, Linux, and Windows via WSL using pyca/cryptography>=45 native ML-KEM-768. The Rust binary is an optional darwin/arm64 fast-path; all other commands route through the portable Python engine via uv run.

Why does pqc-secrets export fail with failed to decrypt private key?▼

On WSL the legacy machine-bound KEK derives from volatile inputs like kernel version and vNIC MAC, which change after updates or restarts. Recovery requires keygen plus repacking keys; the stable machine.kek store or vault.pqc prevents this failure mode.

What post-quantum algorithms does pqc-secrets use?▼

It uses ML-KEM-768 (FIPS 203) for key encapsulation, AES-256-GCM for symmetric encryption, ML-DSA-65 (FIPS 204) for vault signatures and the audit chain, Argon2id for passphrase derivation, and SHA3-256 for fingerprints. Classical algorithms like RSA and ECDH are forbidden.

Can I verify what my AI agent did with my secrets?▼

Yes, every secrets operation appends a tab-separated record to ~/.config/pqc-secrets/audit.log with mode 0o600. Values are never logged; only SHA3-256 fingerprints (first 16 hex chars) are recorded, which you can verify with shasum -a 256.

Related Skills

Explore More Software Engineering Skills→
diegosouzapwdiegosouzapw
59.5k

omni-auth

Manage API key authentication and session tokens for the OmniRoute API.

Community
Intermediate
obispobrunoobispobruno
1

setup-devops-agent

Configure and diagnose the AWS DevOps Agent MCP server connection in .mcp.json.

Community
Advanced
pagerguildpagerguild

quantum-signing

Sign AI agent operations with ML-DSA-65 and SHA3-512 fingerprints.

Official
Advanced
ollieb89ollieb89

secrets-management

Manage CI/CD pipeline secrets with Vault or AWS Secrets Manager.

Community
Advanced