| name | export-credentials |
| version | 0.0.1 |
| global | true |
| allowed-tools | ["Bash","Read","Write"] |
| description | Securely export credentials from local credential stores without exposing them to the AI.
Use this skill when the user needs to:
- Add credentials to GitHub Secrets or other repository secrets
- Deploy credentials to cloud development environments
- Manage credentials across multiple repositories or services
- Create secure configuration files without logging secrets
The skill reads credentials from the user's local credential store (macOS Keychain,
Linux pass, Windows Credential Manager, or environment), auto-detects what's available,
and generates scripts to deploy them securely. Secrets never enter the AI context —
this is a zero-trust approach where credentials are read and used only locally.
|
Export Credentials Securely
Manage credentials across repositories and environments without exposing them to the AI.
This skill reads from your local credential store, auto-discovers available credentials, and
generates scripts to deploy them safely.
How it Works
- Read credentials locally — Queries your credential store (Keychain, pass, Windows CM, etc.)
- Never expose secrets to AI — Only credential names appear in the AI response; values stay local
- Generate deployment scripts — Creates shell scripts that use credentials without exposing them
- Execute with approval — Runs scripts locally on your machine; you review before execution
- Report results — Confirms success/failure (✓ added X secrets) without showing values
What You Can Do
Add credentials to GitHub Secrets:
Add my credentials to owner/repo
Create a secure local .env file:
Generate a .env file with my API keys (don't commit this!)
Deploy credentials to a service:
Set up secrets for my repository
How to Use
When you ask the AI to manage credentials, tell it:
- What credentials (or "all credentials" to auto-detect)
- Where they're stored (or rely on defaults: Keychain on macOS,
pass on Linux, etc.)
- What to do with them (add to GitHub, create .env, deploy, etc.)
Examples
"Add all my credentials from Keychain to github.com/owner/repo"
"Create a .env file with these API keys: OPENAI_API_KEY, ANTHROPIC_API_KEY"
"Deploy my credentials to owner/repo"
Behind the Scenes
- Detects available credentials (queries local credential store)
- Generates Bash scripts for execution
- Shows you the script before execution for review
- Executes the script with your approval
- Reports results securely (no credential values logged or exposed)
Security Guarantees
✓ Credentials read only by local scripts
✓ No credential values exposed to AI or logs
✓ Scripts are human-reviewable before execution
✓ Supports multiple credential stores (Keychain, pass, Windows CM, environment)
✓ Only success/failure reported back
Supported Credential Stores
The skill auto-detects and uses:
- macOS: Keychain (
security command)
- Linux:
pass (password manager) or environment variables
- Windows: Credential Manager (
cmdkey command)
- Any OS: Environment variables as fallback
Supported Deployment Targets
- GitHub Secrets
- Local
.env files (with security warnings)
- Future: AWS Secrets Manager, Azure Key Vault, etc.
Pipeline Integration
Works standalone or as part of the credential skills pipeline:
- credential-best-practices — Set up your credential store and profile
- audit-credentials — Validate compliance, get a score
- export-credentials (this skill) — Deploy only credentials that passed audit
If ~/.agents/audit-report.json exists, credentials listed as failed are
automatically skipped. Use SKIP_AUDIT=true to bypass.
Requirements
- Shell: Bash
- Platforms: macOS, Linux, WSL
- Tools: Requires
gh CLI for GitHub operations (optional for other operations)
Works With
This skill is AI-agnostic and works with any assistant on Unix/Linux/macOS:
- Claude (Claude.ai, Claude Code)
- OpenCode
- Gemini
- Any AI with Bash execution capability
