メニュー
Load, list, verify, and store API keys. Canonical source is macOS Keychain (service=lazar). Use when you need a credential, to check which providers work, or after rotating keys. Never print secret values.
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
How I notice a recurring failure of my own, root-cause it, fix what I can myself (behavioral rules, config, ignore files), and — for anything needing a kernel change I can't apply — draft a verified proposal for the operator to review. The capstone that turns my mistakes into durable fixes. Use when I hit a repeated mistake, get corrected by the operator, see a failed VERIFY, or notice a pattern worth fixing.
The ONLY sanctioned way to delegate work to a lazar sub-agent. Uses locked bin/lazar-spawn (not agent-writable skills logic) — lints the prompt, bounds retries, wall-clock-kills wedged children, and gates success by re-checking declared claims against the filesystem. Raw `lazar -p` is vetoed by a pre-tool hook. Use whenever you need to fan out work, isolate context, or run something as a separate agent. Provider-agnostic.
Turn raw stream.jsonl logs into durable, readable memory — a work journal of what I built and worked on — so the multi-MB archives stop being the only record of my own history. Run after sessions, before pruning logs, or whenever I can't recall recent work. Pairs with _meta/distill (the learnings layer). Use when logs are large, when I've lost track of what I've done, or when preparing to prune/compress the log archives.
Verify lazar is installed correctly and all load-bearing behaviors work end-to-end. Runs static checks (kernel locked, env vars, skills present), boundary tests (sandbox enforcement), live behavior tests (log auto-rotation, memory persistence, recursion), and short end-to-end builds in TypeScript and Python. Runs in a temp directory under workspace/, cleans up after itself, prints PASS/FAIL with a summary at the end. Use after install, after kernel rebuild, after --reset-all, or anytime something feels off.
Scaffold a terminal interface for lazar — a small client project under workspace/<name>/ that consumes `lazar -p --output-format stream-json` and renders the events. Default stack: TypeScript + readline. Optional: Go + Bubble Tea, Python + Textual, or anything else the user wants. Use when the user asks for a "TUI", "chat UI", "interface" for lazar that's richer than `lazar-chat.sh`.
| name | env-vars |
| description | Load, list, verify, and store API keys. Canonical source is macOS Keychain (service=lazar). Use when you need a credential, to check which providers work, or after rotating keys. Never print secret values. |
Canonical store: macOS Keychain, service lazar, account = env var name
(e.g. account MINIMAX_API_KEY).
Plaintext files (.env, provider-env.sh) are loaders/fallbacks only.
Never echo, log, or commit secret values — names and char-lengths only.
All under $LAZAR_HOME/skills/env-vars/ (or seed src/seed-skills/_meta/env-vars/).
| Script | Purpose |
|---|---|
keychain-list.sh | Names + present/missing + length |
keychain-get.sh NAME | Print one secret to stdout (for capture) |
keychain-get.sh NAME --meta | Length only |
keychain-export.sh | source or eval "$(… --print)" to export all |
keychain-store.sh | Import from .env + provider-env.sh into Keychain |
keychain-verify.sh | Live HTTP probe per key (PASS/FAIL, no secrets) |
# What's stored?
bash "$LAZAR_HOME/skills/env-vars/keychain-list.sh"
# Load all keys into this shell
source "$LAZAR_HOME/skills/env-vars/keychain-export.sh"
# or: eval "$(bash "$LAZAR_HOME/skills/env-vars/keychain-export.sh" --print)"
# One key for a command (don't log it)
export MINIMAX_API_KEY="$(bash "$LAZAR_HOME/skills/env-vars/keychain-get.sh" MINIMAX_API_KEY)"
# Prove keys still work
bash "$LAZAR_HOME/skills/env-vars/keychain-verify.sh"
# 1. Put the new value in the environment (or temporarily in .env)
export MINIMAX_API_KEY='…' # paste once; do not commit
# 2. Store into Keychain
bash "$LAZAR_HOME/skills/env-vars/keychain-store.sh" --from-env
# or only one: bash …/keychain-store.sh --one MINIMAX_API_KEY
# 3. Verify
bash "$LAZAR_HOME/skills/env-vars/keychain-verify.sh"
Bulk import from existing files (still works if files have values):
bash "$LAZAR_HOME/skills/env-vars/keychain-store.sh"
workspace/provider-switch/provider-env.sh loads from Keychain.
start-proxy.sh sources that file.
source "$LAZAR_HOME/workspace/provider-switch/provider-env.sh"
# or full export:
source "$LAZAR_HOME/skills/env-vars/keychain-export.sh"
export ANTHROPIC_BASE_URL="https://api.minimax.io/anthropic"
export ANTHROPIC_API_KEY="$MINIMAX_API_KEY"
Non-secret config stays in $LAZAR_HOME/.env (e.g. ANTHROPIC_BASE_URL, LAZAR_MODEL).
If a key is missing from Keychain, check (names only):
$LAZAR_HOME/.env~/.env (real home)workspace/provider-switch/provider-env.shexport lines)op item get … if installedsecrets-scan before sharing any file that might contain keys.bash "$LAZAR_HOME/skills/env-vars/keychain-list.sh"
bash "$LAZAR_HOME/skills/env-vars/keychain-verify.sh"
All three load keys via scripts/lazar-env.sh and default to MiniMax-M3 direct.
Switch provider: LAZAR_BACKEND=xai lazar -p "..." or lazar-backend openrouter.