How do I install the Hashicorp Vault skill?

Run npx skillmds@latest add dvcrn/hashicorp-vault in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Hashicorp Vault safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: makes network calls, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Hashicorp Vault?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Hashicorp Vault free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Hashicorp Vault?

dvcrn (@dvcrn) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Hashicorp Vault by dvcrn — Agent Skill

Name: Hashicorp Vault
Rating: 4.2 (5 reviews)
Author: dvcrn

Hashicorp Vault

Work with HashiCorp Vault using the `vault` CLI for authentication checks, KV secret reads and writes, listing paths, enabling and tuning secrets engines, policy inspection, token lookup, and operational troubleshooting. Use when tasks mention HashiCorp Vault, Vault KV, secret paths like `secret/` or `kv/`, `VAULT_ADDR`, `VAULT_TOKEN`, AppRole, policies, mounts, or the `vault` command.

dvcrn Updated Sep 8, 2026 32 repo stars

File contents

HashiCorp Vault CLI

Use the vault CLI for Vault work. Prefer read-only inspection first, then confirm before writing secrets, changing auth methods, enabling engines, or editing policies.

Quick checks

vault version
vault status
vault auth list
vault secrets list
vault token lookup

If VAULT_ADDR is missing, set it first:

export VAULT_ADDR='https://vault.example.com'

For Jim's local Vault, use the tested local endpoint:

export VAULT_ADDR='http://192.168.1.106:8200'
vault status
curl -s "$VAULT_ADDR/v1/sys/health"

Notes for the local environment:

http://192.168.1.106:8200 responded successfully.
https://192.168.1.106:8200 returned a wrong-version TLS error, so this endpoint is HTTP, not HTTPS.
vault.jimcom2.local did not resolve from this runtime, so prefer the IP unless local DNS/mDNS is fixed.

Verify auth before assuming a path is missing:

vault token lookup
vault kv get secret/my-app

Read secrets

For KV v2 paths, use vault kv commands instead of raw API-style paths.

vault kv get secret/my-app
vault kv get -field=password secret/my-app
vault kv list secret/

If output is unclear, use JSON:

vault kv get -format=json secret/my-app
vault secrets list -format=json

Write secrets

Confirm before overwriting or deleting anything.

vault kv put secret/my-app username=app password='s3cr3t'
vault kv patch secret/my-app password='rotated'

Prefer patch when updating a subset of keys on KV v2.

Policies and mounts

Inspect first:

vault policy list
vault policy read my-policy
vault secrets list -detailed

Change only with explicit user intent:

vault policy write my-policy ./policy.hcl
vault secrets enable -path=secret kv-v2
vault secrets tune -max-versions=10 secret/

Authentication helpers

Common login flows:

vault login
vault login -method=userpass username=<user>
vault write auth/approle/login role_id=<role_id> secret_id=<secret_id>

When troubleshooting auth, inspect enabled auth backends and token details first:

vault auth list -detailed
vault token lookup

Troubleshooting workflow

Check vault status and VAULT_ADDR.
Check auth with vault token lookup or the intended login flow.
Confirm mount names with vault secrets list.
For KV access, verify whether the engine is KV v1 or KV v2 before choosing commands.
Prefer -format=json when output will be parsed or compared.
Read references/kv-and-troubleshooting.md for command patterns and common errors when the task is non-trivial.

---name: hashicorp-vaultdescription: Work with HashiCorp Vault using the `vault` CLI for authentication checks, KV secret reads and writes, listing paths, enabling and tuning secrets engines, policy inspection, token lookup, and operational troubleshooting. Use when tasks mention HashiCorp Vault, Vault KV, secret paths like `secret/` or `kv/`, `VAULT_ADDR`, `VAULT_TOKEN`, AppRole, policies, mounts, or the `vault` command.---# HashiCorp Vault CLIUse the `vault` CLI for Vault work. Prefer read-only inspection first, then confirm before writing secrets, changing auth methods, enabling engines, or editing policies.## Quick checks```bashvault versionvault statusvault auth listvault secrets listvault token lookup```If `VAULT_ADDR` is missing, set it first:```bashexport VAULT_ADDR='https://vault.example.com'```For Jim's local Vault, use the tested local endpoint:```bashexport VAULT_ADDR='http://192.168.1.106:8200'vault statuscurl -s "$VAULT_ADDR/v1/sys/health"```Notes for the local environment:- `http://192.168.1.106:8200` responded successfully.- `https://192.168.1.106:8200` returned a wrong-version TLS error, so this endpoint is HTTP, not HTTPS.- `vault.jimcom2.local` did not resolve from this runtime, so prefer the IP unless local DNS/mDNS is fixed.Verify auth before assuming a path is missing:```bashvault token lookupvault kv get secret/my-app```## Read secretsFor KV v2 paths, use `vault kv` commands instead of raw API-style paths.```bashvault kv get secret/my-appvault kv get -field=password secret/my-appvault kv list secret/```If output is unclear, use JSON:```bashvault kv get -format=json secret/my-appvault secrets list -format=json```## Write secretsConfirm before overwriting or deleting anything.```bashvault kv put secret/my-app username=app password='s3cr3t'vault kv patch secret/my-app password='rotated'```Prefer `patch` when updating a subset of keys on KV v2.## Policies and mountsInspect first:```bashvault policy listvault policy read my-policyvault secrets list -detailed```Change only with explicit user intent:```bashvault policy write my-policy ./policy.hclvault secrets enable -path=secret kv-v2vault secrets tune -max-versions=10 secret/```## Authentication helpersCommon login flows:```bashvault loginvault login -method=userpass username=<user>vault write auth/approle/login role_id=<role_id> secret_id=<secret_id>```When troubleshooting auth, inspect enabled auth backends and token details first:```bashvault auth list -detailedvault token lookup```## Troubleshooting workflow1. Check `vault status` and `VAULT_ADDR`.2. Check auth with `vault token lookup` or the intended login flow.3. Confirm mount names with `vault secrets list`.4. For KV access, verify whether the engine is KV v1 or KV v2 before choosing commands.5. Prefer `-format=json` when output will be parsed or compared.6. Read `references/kv-and-troubleshooting.md` for command patterns and common errors when the task is non-trivial.

Frequently asked questions