dvcrn Side_Peace 🍒
Dead simple secret handoff from human to AI. No npm packages to trust — just Node.js built-ins.
Key security feature: Secret is written to a temp file, NEVER printed to stdout. This prevents secrets from appearing in chat logs or command output.
How It Works
- Agent runs
node drop.js --label "API Key" - Agent shares the URL with human
- Human opens URL in browser, pastes secret, submits
- Secret is saved to temp file (printed path only, not content)
- Agent reads file, uses secret, deletes file
Usage
# Basic - secret saved to random temp file
node skills/side-peace/drop.js --label "CLAWHUB_TOKEN"
# Custom output path
node skills/side-peace/drop.js --label "API_KEY" --output /tmp/my-secret.txt
# Custom port
node skills/side-peace/drop.js --port 4000 --label "TOKEN"
Reading the Secret
After receiving, the secret is in the temp file:
# Read and use (example with clawhub)
SECRET=$(cat /tmp/side-peace-xxx.secret)
npx clawhub login --token "$SECRET" --no-browser
rm /tmp/side-peace-xxx.secret
Or one-liner:
cat /tmp/side-peace-xxx.secret | xargs -I{} npx clawhub login --token {} --no-browser; rm /tmp/side-peace-xxx.secret
Security
- Zero dependencies — only Node.js built-ins
- Secret never in stdout — written to file with 0600 permissions
- Memory only until saved — temp file deleted after use
- One-time — server exits after receiving
- ~60 lines — fully auditable
Output
🍒 Side_Peace waiting...
Label: CLAWHUB_TOKEN
Output: /tmp/side-peace-a1b2c3d4.secret
Local: http://localhost:3000
Network: http://192.168.1.94:3000
Waiting for secret...
✓ Secret received and saved.
File: /tmp/side-peace-a1b2c3d4.secret
(Secret is NOT printed to stdout for security)
The secret is in the file. Read it, use it, delete it.