skill-secret-management

Copilot skill for secure secret management using an inject model — the agent orchestrates operations but never sees secret values through script code paths. The injected subprocess is agent-chosen and may produce output containing the value — use purpose-built commands.

Architecture

Agent (LLM context)          │  Script (subprocess)
─────────────────────────────┼───────────────────────────────
"store GITLAB_TOKEN"    ──►  │  read -rsp → backend write
"inject KEY -- cmd"     ──►  │  backend read → env KEY=val cmd
"list"                  ──►  │  key names only → stdout
"exists KEY"            ──►  │  exit code 0/1
"delete KEY"            ──►  │  backend delete
                             │
  Agent sees: exit codes,    │  Script sees: secret values
  key names, cmd output      │  (scoped, never printed)

Install

git clone https://github.com/tyler555g/skill-secret-management.git ~/.copilot/skills/secret-management

Operations

| Op | Command | What Happens | Agent Sees | |----|---------|-------------|------------| | store | secret-ops.sh store KEY | Interactive read -rsp → backend | Exit code | | inject | secret-ops.sh inject KEY --confirm -- cmd args | Retrieves secret, injects via subshell+exec | Command output | | list | secret-ops.sh list | Queries backend for key names | Key names (GCM: unsupported) | | delete | secret-ops.sh delete KEY --confirm | Removes from backend | Exit code | | exists | secret-ops.sh exists KEY | Checks backend | Exit 0=yes, 1=no |

Backends

| Backend | Tool | OS | Auto-detect Priority | |---------|------|----|---------------------| | HashiCorp Vault | vault | Any | 1st (if VAULT_ADDR set + authenticated) | | macOS Keychain | security | macOS | 2nd | | Linux keyring | keyctl | Linux | 3rd | | Git Credential Manager | git credential-manager | Any | 4th (cross-platform fallback) |

Backend is pinned on first use to ~/.config/secret-ops/backend. No silent downgrade.

Security Model

• No reveal — there is no get/read command. Only inject (scoped subprocess via subshell+exec).
• Namespaced storage — all backends use secret-ops: prefix / secret/secret-ops/ path to isolate from unrelated credentials.
• Deterministic GCM — forces credential.helper=manager and credential.useHttpPath=true on every call.
• Approval gates — inject and delete require --confirm flag. Agent must ask user before passing it.
• Fail-closed — if the pinned backend fails, the operation fails. No fallback chain.
• No argv leaks — secrets injected via shell export in a subshell, not env command argv.
• Locked backend pinning — first-use detection uses flock/mutex to prevent race conditions.
• Key validation — key names restricted to [A-Za-z0-9_.-]+ (max 256 chars). Inject further restricted to env-var-safe.
• Hardened permissions — config directory set to 0700.
• Audit log — every operation logged to ~/.config/secret-ops/audit.log (ops only, never values).
• AI-Human Principle 3 — agent never asks for, sees, or handles secret values through script code paths.

Token Efficiency

SKILL.md is protocol-only (~625 tokens). All logic lives in scripts that are executed but never loaded into context. ~90% reduction vs v0.1.0.

Authoritative Sources

• Apple Keychain Services
• Linux keyctl man page
• Linux kernel key management
• Git Credential Manager
• HashiCorp Vault
• AI-Human Interaction Defaults
• 12-Factor Agents

License

MIT