credential-vault

name	credential-vault
description	Secure credential management with local encryption, auto-rotation, and audit logging. Manage API keys, tokens, and passwords with enterprise-grade security.

🔐 Credential Vault

Manage API keys dengan enkripsi lokal, auto-rotate, dan audit log.

🎯 Features

🔒 Local Encryption

• AES-256 encryption untuk semua credentials
• Master key derived dari system fingerprint
• Ga ada data yang keluar dari local machine

🔄 Auto-Rotation

• Schedule automatic key rotation
• Support untuk: OpenAI, Anthropic, Serper, dll
• Backup old keys sebelum rotate

📊 Audit Logging

• Track semua access ke credentials
• Siapa yang access, kapan, untuk apa
• Alert untuk suspicious access patterns

🎭 Access Control

• Role-based access (admin, user, readonly)
• Per-skill credential isolation
• Temporary access tokens

🚀 Usage

# Add new credential
bash skills/credential-vault/scripts/vault.sh add \
  --name serper_api \
  --value "b899bdfcbf7a..." \
  --type api_key

# Get credential (for scripts)
bash skills/credential-vault/scripts/vault.sh get --name serper_api

# List all credentials
bash skills/credential-vault/scripts/vault.sh list

# Rotate credential
bash skills/credential-vault/scripts/vault.sh rotate --name openai_api

# View audit log
bash skills/credential-vault/scripts/vault.sh audit

📁 Storage Structure

credential-vault/
├── vault/
│   ├── encrypted_credentials.json
│   ├── master.key (encrypted)
│   └── rotation_schedule.json
├── logs/
│   ├── access_log.json
│   └── rotation_log.json
└── backup/
    └── credentials_YYYY-MM-DD.enc

🔐 Encryption

# Implementation detail
from cryptography.fernet import Fernet
import hashlib

# Master key dari system fingerprint
system_fp = f"{hostname}-{username}-{cpu_serial}"
master_key = hashlib.sha256(system_fp.encode()).digest()

# AES-256 encryption
cipher = Fernet(base64.urlsafe_b64encode(master_key))
encrypted = cipher.encrypt(credential.encode())

🔄 Auto-Rotation

rotation_schedule.json:

{
  "credentials": [
    {
      "name": "openai_api",
      "rotate_every_days": 90,
      "last_rotated": "2026-01-01",
      "next_rotation": "2026-04-01",
      "provider": "openai"
    },
    {
      "name": "serper_api", 
      "rotate_every_days": 180,
      "last_rotated": "2026-02-01",
      "next_rotation": "2026-08-01",
      "provider": "serper"
    }
  ]
}

📊 Audit Log Format

{
  "timestamp": "2026-02-22T15:30:00Z",
  "action": "access",
  "credential_name": "serper_api",
  "accessed_by": "smart-search",
  "ip_address": "127.0.0.1",
  "success": true,
  "context": "Web search for query"
}

🔔 Alerts

Kirim Telegram alert kalau:

• Credential diakses dari script tidak dikenal
• Failed access attempts > 3x
• Rotation gagal
• Backup gagal

⚙️ Configuration

config.json:

{
  "encryption": {
    "algorithm": "AES-256-GCM",
    "key_derivation": "PBKDF2",
    "iterations": 100000
  },
  "rotation": {
    "enabled": true,
    "check_interval": "daily",
    "alert_before_days": 7
  },
  "audit": {
    "log_all_access": true,
    "retention_days": 365,
    "alert_on_suspicious": true
  },
  "backup": {
    "enabled": true,
    "schedule": "weekly",
    "keep_count": 4
  }
}

🔧 Integration

Untuk skill lain yang mau pakai:

# Dalam script skill lain
API_KEY=$(bash skills/credential-vault/scripts/vault.sh get --name serper_api)
curl -H "X-API-KEY: $API_KEY" ...

🛡️ Security Features

• ✅ Zero-knowledge architecture
• ✅ Memory-safe credential handling
• ✅ Automatic memory clearing
• ✅ Protection against memory dumps
• ✅ Rate limiting untuk access