skills.rest
openkaiden
openkaidenOFFICIAL
Explore all skills by this author →
GitHub

working-with-secrets

Store secret values in the system keychain and metadata in a local secrets.json registry.

10|14|Updated Feb 26, 2026
Search Tags:#security#registry#secrets#keychain#secret-store#secret-service
One-click install
npx skills add https://github.com/openkaiden/kdn --skill working-with-secrets
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: working-with-secrets
Source: https://github.com/openkaiden/kdn/tree/main/.agents/skills/working-with-secrets
Command: npx skills add https://github.com/openkaiden/kdn --skill working-with-secrets

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill enables secure management of secrets by storing values in the system keychain and persisting non-sensitive metadata in a local JSON store, preventing exposure of sensitive data on disk.

Core Features & Use Cases

  • Store abstraction with a secure, system keychain for secret values and a secrets.json registry for metadata.
  • SecretService registry that maps named secret types to HTTP descriptor definitions used inside workspaces.
  • Centralized registration that loads definitions from embedded configuration and exposes ListAvailable() and RegisterAll() for dynamic extension.
  • Use in workspace initialization and deployment workflows to register, describe, and retrieve secrets without exposing values.

Quick Start

Create a new secret named 'my-token' and securely store its value in the system keychain.

Frequently Asked Questions about working-with-secrets

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage secrets securely in a local development workspace?▼

To manage secrets securely, store the secret values in the system keychain and save non-sensitive metadata in a local secrets.json registry, preventing sensitive data exposure on disk.

What is the best way to inject secrets during runtime provisioning without disk exposure?▼

The best way to inject secrets without disk exposure is using a SecretService registry that maps named secret types to definitions and retrieves values directly from the system keychain.

How do I register a new secret type for deployment workflows?▼

You register a new secret type by loading definitions from embedded configuration and calling RegisterAll(), which dynamically extends the central secret services setup for your deployment workflows.

Does this approach store API tokens directly in the secrets.json file?▼

No, it does not store API tokens in secrets.json. The JSON file only holds metadata, while the actual secret values are kept in the system keychain to ensure secure retrieval.

Can I list all available secret definitions before initializing a workspace?▼

Yes, you can list all available secret definitions before workspace initialization by calling the ListAvailable() method exposed by the central secret services setup.

What operations does the Store interface support for secret management?▼

The Store interface supports Create, List, Get, and Remove operations, allowing you to securely manage secrets and metadata throughout the workspace lifecycle.

Related Skills

Explore More Software Engineering Skills→
heaptracetechnologyheaptracetechnology
13

Manage Secrets

Manage AWS application secrets with SSM Parameter Store and Secrets Manager.

Community
Advanced
onesmartguyonesmartguy
2

secrets-management

Manage sensitive credentials securely across CI/CD pipelines and secret stores.

Community
Advanced
reflecterlabsreflecterlabs

railway-deploy

Deploy Lucid Agents to Railway with GitHub repo creation and domain provisioning.

Official
Advanced
julianobarbosajulianobarbosa
7

1password

Retrieve and inject 1Password secrets via op CLI and Kubernetes operators.

Community
Intermediate