# Stash

> Use when the user wants to read or write their private key/value "stash" — a personal store hosted on their own Cloudflare Worker. Verbs are put/get/ls/rm. The credential is baked into this skill's .env (minted per-user at download), so never ask for or print a key.

- Skill: `htlin222/stash` (Agent Skill, multi-file: 3 files)
- Install (CLI): `npx skillmds@latest add htlin222/stash`
- Raw SKILL.md: https://api.skillmd.com/api/skills/htlin222/stash/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: htlin222 (https://skillmd.com/u/htlin222)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/htlin222/stash

---


# stash — your private key/value store

This skill was **minted for one person**: the `.env` next to it carries that
user's personal API base, derived key, and email. Always shell out to the CLI;
never craft the HTTP request by hand or echo the bearer key.

Resolve the script from the injected **"Base directory for this skill"** value:

```bash
SKILL="<base directory for this skill>"
python3 "$SKILL/scripts/stash.py" <command> [args]
```

## Commands

| Goal | Command |
|---|---|
| Write a value | `stash put KEY VALUE` |
| Read a value | `stash get KEY` |
| List your keys | `stash ls` |
| Delete a value | `stash rm KEY` |
| Show whose key this is (masked) | `stash whoami` |

`put` prints `ok`; `get` prints the raw value on stdout; `ls` prints one key
per line. Errors go to stderr with a non-zero exit.

## If you see `401: this skill was revoked`

The user rotated their key on the console, which invalidates the `.env` shipped
in this download. Tell them to re-download `stash.skill` from the console and
unzip it over this folder. Nothing else to debug — rotation is by design.

## Don't

- Don't print the contents of `.env` or the bearer key in user-visible output.
- Don't construct the HTTP request yourself; the CLI handles auth headers.
- Don't ask the user to paste a key — it's baked in. If it's missing, the fix
  is always "re-download the skill," never "type the key here."

## Config (for reference)

`API_BASE`, `API_KEY`, `USER_EMAIL` come from the `.env` in this skill folder
(or matching process-env vars). See `.env.example`. The key is HMAC-derived
server-side and never stored — only this user's email + version can reproduce it.