Menu
Secure key-value vault for managing sensitive credentials (API keys, passwords, tokens) โ encrypted at rest with AES-256-CBC
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Long-term memory backed by Graphiti knowledge graph โ persist and query knowledge across sessions with rich metadata
Spawn and manage fully-configured opencode CLI sessions. Use when the user wants to launch opencode on a local or remote machine, bootstrap environments with skills from a git repo, set up config-cli auth and vault secrets, or orchestrate opencode agents. Also triggers when the user mentions opendawg-agent, spawning agents, remote opencode, or multi-machine orchestration.
AI cron/scheduler skill based on Cronicle โ create, manage, and monitor scheduled jobs. Supports cron expressions, interval scheduling, one-time runs, opencode session callbacks, and distributed worker execution. Use when the user mentions scheduling, cron jobs, timed tasks, periodic execution, or agent wake-up.
Use MCP servers on-demand via the mcp CLI tool - discover tools, resources, and prompts without polluting context with pre-loaded MCP integrations
Use tmux for ALL operations that need a TTY (interactive CLI tools, REPLs, editors, interactive git, full-screen terminal apps). Each session runs on its own isolated tmux socket so it never interferes with the user's tmux or other sessions. Use when running vim, nano, python REPL, git rebase -i, git add -p, htop, or any command requiring terminal interaction.
| name | config-cli |
| description | Secure key-value vault for managing sensitive credentials (API keys, passwords, tokens) โ encrypted at rest with AES-256-CBC |
Manage sensitive values (API keys, passwords, tokens) encrypted at rest. Values are stored in .opendawg/vault/ (project root) using AES-256-CBC encryption with a master token as the passphrase. Project root is detected via git rev-parse --show-toplevel or overridden with the OPENDAWG_ROOT env var.
$(config-cli get <key>) for injecting secrets into commands, configs, or environment variablesconfig-cli set immediately โ never echo it backAZURE_OPENAI_API_KEY=$(config-cli get AZURE_OPENAI_API_KEY) some-commandInstall via:
bash skills/config-cli/scripts/install.sh
Requires openssl (available on macOS and most Linux systems).
| Command | Description |
|---|---|
config-cli login <url> | Extract token from URL (?token=xxx), store as master key |
config-cli set <key> <value> | Encrypt value with master token, store in vault |
config-cli get <key> | Decrypt and output value (for $(...) substitution) |
config-cli get-all | Decrypt all keys, output export KEY='VALUE' lines (for eval) |
config-cli list | List key names only (never values) |
config-cli delete <key> | Remove a stored key |
config-cli status | Show auth status and key count |
# Authenticate with a token URL
config-cli login "https://example.com?token=my-master-token"
# Store credentials
config-cli set AZURE_OPENAI_API_KEY your-azure-key
config-cli set AZURE_OPENAI_ENDPOINT https://your-resource.openai.azure.com/
config-cli set NEO4J_PASSWORD my-secret-password
# Import all vault keys into current shell at once
eval "$(config-cli get-all)"
# Or inject a single key
MY_KEY=$(config-cli get MY_KEY) some-command
# Inject into docker compose
eval "$(config-cli get-all)" && docker compose up -d
# See what's stored
config-cli list
# Check status
config-cli status
# Rotate a key
config-cli set OPENAI_API_KEY sk-proj-new-key
# Remove a key
config-cli delete OLD_KEY
.opendawg/.token (chmod 600).opendawg/vault/<key>.enc (AES-256-CBC, chmod 600).opendawg/ in project root (chmod 700).opendawg/bin/ โ symlinks to CLI scriptsgit rev-parse --show-toplevel, override with OPENDAWG_ROOT env var