From handle-secrets
Best practices for handling user-provided secrets in CLI tools. Use when: (1) building CLI tools that accept API keys, tokens, or passwords from users, (2) reviewing secret-handling code for security issues, (3) choosing between input methods (env vars, stdin, keychains, config files), (4) implementing credential storage or retrieval. Covers the security hierarchy of input methods, credential storage patterns, secret masking, and language-specific libraries.
How this skill is triggered — by the user, by Claude, or both
Slash command
/handle-secrets:handle-secretsThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Best practices for handling secrets that **users pass to your CLI tool** (API keys, tokens, passwords), not secrets used during development.
Best practices for handling secrets that users pass to your CLI tool (API keys, tokens, passwords), not secrets used during development.
ps aux, recorded in shell history, and captured by audit logs| Method | Safety | Use when |
|---|---|---|
| OS keychain / credential helper | Safest | Persistent storage for interactive users |
Secret references (op://, vault URIs) | Safe | Storing pointers instead of secrets |
| Stdin / pipes / file descriptors | Safe | Automation and scripting |
| Interactive TTY prompt | Safe | Human users at a terminal |
| Config files (0600 permissions) | Acceptable | Persistent storage without keychain |
| Environment variables | Acceptable | CI/CD pipelines and containers |
| Command-line arguments | Never | - |
references/checklist.mdreferences/security-hierarchy.mdreferences/design-patterns.mdreferences/anti-patterns.mdreferences/language-libraries.mdQuick reviews (default):
references/checklist.md - Condensed, actionable rulesDeep dives by topic:
references/security-hierarchy.md - Ranked input methods with attack surfaces and mitigationsreferences/design-patterns.md - Credential fallback chains, OAuth device flow, token hygiene, maskingreferences/anti-patterns.md - Real CVEs and incidents from insecure secret handlingreferences/language-libraries.md - Rust, Go, Python, Node.js, Ruby libraries and code patternsTools should resolve credentials in this order:
Never fall through to accepting --password <value> as an argument.
Guides creation, editing, and verification of skills for AI coding agents using test-driven development with subagent scenarios. Use when authoring or debugging skills.
npx claudepluginhub cboone/agent-harness-plugins --plugin handle-secrets