菜单
Use for agent runtime integration: discover Hermes/OpenClaw installs, bootstrap SecretZero environments with `secretzero agent list` / `agent adopt`, lockfile preseed, and restore loops. Inherits absolute rule from `skills/secretzero/SKILL.md` (SecretZero only; never secrets in context).
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Use for agentic and operational SecretZero workflows including unified `agent sync`, CLI/API/MCP parity, secure human-in-the-loop vectors, and automation-safe run loops.
Use when authoring, reviewing, or walking a user through a new or existing `Secretfile.yml`. Guided session: manifest root, inventory table, optional local discovery, add/edit loop with secret-type and target menus, validate, optional `secretzero web`. Hermes + MCP notes included. Safe contextless discovery, `.szvar` lanes, policy-bound targets. Inherits absolute rule from `skills/secretzero/SKILL.md`. Co-load `skills/secretzero-handle/SKILL.md` for `.env` / spill-safe CLI.
Use when the task touches `.env`, dotenv/json/yaml secret files, local `file` targets, or any workflow where secret material could enter agent context. Enforces `SZ_AGENT_MODE=true` spill-safe CLI usage, ingest preseed, strict manifest validation, and safe discovery patterns alongside `secretzero-agent` / `secretzero-author`.
Compatibility entrypoint for SecretZero skills. Enforces the absolute rule: never consume secrets in agent context — use SecretZero for all secret handling. Routes to secretzero-author, secretzero-agent, secretzero-handle, and secretzero-agent-adopt.
Use for agentic and operational SecretZero workflows including unified `agent sync`, CLI/API/MCP parity, secure human-in-the-loop vectors, and automation-safe run loops.
Use when authoring, reviewing, or walking a user through a new or existing `Secretfile.yml`. Guided session: manifest root, inventory table, optional local discovery, add/edit loop with secret-type and target menus, validate, optional `secretzero web`. Hermes + MCP notes included. Safe contextless discovery, `.szvar` lanes, policy-bound targets. Inherits absolute rule from `skills/secretzero/SKILL.md`. Co-load `skills/secretzero-handle/SKILL.md` for `.env` / spill-safe CLI.
| name | secretzero-agent-adopt |
| description | Use for agent runtime integration: discover Hermes/OpenClaw installs, bootstrap SecretZero environments with `secretzero agent list` / `agent adopt`, lockfile preseed, and restore loops. Inherits absolute rule from `skills/secretzero/SKILL.md` (SecretZero only; never secrets in context). |
| license | Apache-2.0 |
| compatibility | Requires SecretZero CLI (Python 3.12+). Set SZ_AGENT_MODE=true for automated adopt flows. |
| metadata | {"author":"secretzero","version":"1.1"} |
| allowed-tools | Bash(secretzero:*) Read |
Use when an agent runtime (Hermes, OpenClaw, or future claw-like installs) needs a SecretZero environment, disaster recovery, or GitOps capture of present credentials.
Pair with skills/secretzero-agent/SKILL.md (sync vectors) and
skills/secretzero-handle/SKILL.md (spill-safe mode).
README.md HTML comment agent-entrypoint block.uv tool install -U "secretzero[all]".export SZ_AGENT_MODE=true.secretzero agent list --format json
secretzero agent adopt --dry-run --format json
secretzero agent adopt --format json
GitOps capture into the workspace:
secretzero agent adopt --target hermes --source-dir ~/.hermes --output-dir ./agents/hermes --template
| Command | Purpose |
|---|---|
secretzero agent list | Detect Hermes/OpenClaw installs + existing SecretZero envs |
secretzero agent adopt | Write Secretfile.yml (present credentials only) |
secretzero agent backup | Alias of adopt — not secretzero backup create |
default: null — never copy live values into YAML.--preseed-lockfile to hash present values without printing them.secretzero agent sync --web.secretzero backup create --encrypted after adopt/sync.secretzero agent list --format json
secretzero agent adopt --target hermes --preseed-lockfile --format json
secretzero validate -f ~/.hermes/Secretfile.yml
secretzero agent sync --json -f ~/.hermes/Secretfile.yml
secretzero sync -f ~/.hermes/Secretfile.yml
Repeat agent sync until pending_secrets is empty.
--target omitted → try Hermes, then OpenClaw.--source-dir omitted → default install paths (~/.hermes, ~/.openclaw, env overrides).reason.output-dir.agent sync / sync complete with no pending manual secrets.