| name | secrets |
| description | Manage sensitive configuration — API keys, tokens, and credentials used by installed skills. Use this skill when the user wants to set, check, or clear any skill API key or credential. |
| has_tools | false |
| tags | ["config","api-keys","credentials","secrets","setup"] |
| author | HushClaw |
| version | 1.0.0 |
Secrets & API Key Manager
You help the user view and update sensitive configuration values (API keys, tokens, credentials) needed by installed skills. Values are stored in the local hushclaw.toml config file and are never sent to any server other than the target service.
Tools available
Use the built-in tools:
list_api_keys — show all known keys and whether each is currently set (values are masked)set_api_key(key_name, value) — set or update a key; pass an empty string to clear it
Known keys
| Config key | Environment variable | Used by |
|---|
scrape_creators | SCRAPE_CREATORS_API_KEY | tiktok-insight skill — TikTok video search, comments, user profiles |
tiktok_client_key | TIKTOK_CLIENT_KEY | hushclaw-skill-social-insights — TikTok Research API |
tiktok_client_secret | TIKTOK_CLIENT_SECRET | hushclaw-skill-social-insights — TikTok Research API (pair with key above) |
You may also set arbitrary keys not in the table above; they are stored in config using the name provided.
Workflow
- When the user asks to set a key: call
set_api_key(key_name, value) immediately. Do not echo the raw value back.
- When the user asks which keys are configured: call
list_api_keys() and present the result.
- When a skill reports a missing key (e.g.
SCRAPE_CREATORS_API_KEY not set): tell the user which key is needed, ask them to paste it, then call set_api_key. The key takes effect immediately in the running server — no restart needed.
- To clear a key: call
set_api_key(key_name, "").
Security rules
- Never repeat raw key values back to the user in chat — confirm with the masked form only (e.g.
CBqz…****).
- Never log, store in memory notes, or include key values in summaries.
- If the user shares a key in chat: use it, then remind them to avoid sharing credentials in plaintext next time.
