vault

Store and retrieve secrets in an AES-256-GCM encrypted vault.

14|6|Updated Feb 13, 2026

Search Tags:#security #encryption #secrets #vault #key-management #aes-256-gcm #credential-storage

Ready to run

npx skills add https://github.com/jholhewres/devclaw --skill vault-jholhewres

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: vault
Source: https://github.com/jholhewres/devclaw/tree/main/pkg/devclaw/copilot/builtin/skills/vault
Command: npx skills add https://github.com/jholhewres/devclaw --skill vault-jholhewres

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Securely manage sensitive credentials so they are not exposed in memory, logs, or casual storage and to prevent accidental data loss from unsafe overwrite or delete operations.

Core Features & Use Cases

Encrypted storage: AES-256-GCM encryption for secrets at rest.
Simple CRUD actions: name-based save, get, list, status, and explicit delete with overwrite-on-save behavior.
Safety rules: Prevents accidental destructive flows by requiring explicit delete and discouraging storing secrets in memory.
Use Case: Store API keys, tokens, database URLs, or passwords required by agents or CI/CD pipelines and retrieve them when making authenticated API calls or provisioning infrastructure.

Quick Start

Store a new OpenAI API key by issuing vault(action="save", name="OPENAI_API_KEY", value="sk-proj-xxxxx").

Frequently Asked Questions about vault

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I securely store API keys and tokens for automated deployments?▼

Use an encrypted vault to securely store API keys and tokens by issuing a name-based save action. The vault applies AES-256-GCM encryption to protect credentials at rest, preventing exposure in memory or logs during automated deployments or integrations.

What is the best way to manage secrets for agents making authenticated API calls?▼

The best way to manage secrets for authenticated API calls is using an encrypted vault with name-based save, get, and list actions. Agents retrieve credentials on demand, while overwrite-on-save behavior and explicit-delete safeguards prevent accidental data loss.

How does AES-256-GCM encryption protect credentials at rest?▼

AES-256-GCM encryption protects credentials at rest by encrypting stored secrets so they remain unreadable without the decryption key. This mechanism secures sensitive data like database URLs and passwords against unauthorized access or casual storage exposure.

Can I overwrite an existing secret without deleting it first?▼

Yes, you can overwrite an existing secret by issuing a save action with the same name, which replaces the stored value. However, deleting a secret requires an explicit delete action to provide safeguards against accidental data loss from unsafe flows.

How do I retrieve stored database URLs when provisioning infrastructure?▼

Retrieve stored database URLs by issuing a get action with the specific secret name. This fetches the encrypted credential from the vault, allowing applications or CI/CD pipelines to use the database URL for provisioning infrastructure.

What are the limitations of storing secrets in memory for applications?▼

Storing secrets in memory risks exposure through logs or unauthorized access, so the vault discourages this practice. The vault prevents accidental destructive flows by requiring explicit delete actions, but it does not manage runtime memory isolation.