How do I install the Bao Vault skill?

Run npx skillmds@latest add jankneumann/bao-vault in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Bao Vault skill do?

OpenBao/Vault credential seeding and management scripts It is listed under Coding & Dev Tools on SkillMD.

Is Bao Vault safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Bao Vault?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Bao Vault free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Bao Vault?

jankneumann (@jankneumann) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Bao Vault by jankneumann — Agent Skill

Name: Bao Vault
Rating: 4.666666666666667 (3 reviews)
Author: jankneumann

File contents

Bao Vault Infrastructure Skill

Non-user-invocable infrastructure skill for OpenBao/Vault credential seeding and management.

Scripts

scripts/bao_seed.py

Seeds OpenBao with agent API keys and secrets from agents.yaml configuration. Reads any string-valued key in .secrets.yaml and writes it under the configured KV mount, so adding new credential names (e.g. LANGFUSE_PUBLIC_KEY) requires no code change — just add the key to .secrets.yaml and re-run.

Usage:

python3 "<skill-base-dir>/scripts/bao_seed.py" [options]

Environment variables:

BAO_ADDR — OpenBao server address
BAO_TOKEN — Root or privileged token for seeding
BAO_SECRETS_FILE — secrets YAML path (defaults to .secrets.yaml in the current project)
AGENTS_YAML — agent configuration path (defaults to agents.yaml in the current project)

Both inputs can also be supplied with --secrets-path and --agents-path. The skill does not assume that the consumer contains an agent-coordinator/ checkout.

Exit codes: 0 = seeded successfully, 1 = error

scripts/langfuse_env.sh

Resolves LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, and LANGFUSE_HOST from OpenBao (preferring values already in the environment), computes LANGFUSE_BASIC_AUTH = base64(public:secret), and emits four export lines on stdout. Designed to be sourced via eval:

eval "$("<skill-base-dir>/scripts/langfuse_env.sh")"

Falls back silently when BAO_ADDR is unset or the keys are already populated, so it is safe to put in shell init or scripts.

Authentication: prefers BAO_TOKEN if set, otherwise uses AppRole login via BAO_ROLE_ID + BAO_SECRET_ID (matches bao_seed.py).

Consumed by:

<skill-base-dir>/../langfuse/scripts/install-mcp.sh — computes the literal Basic-auth token written into Codex / Gemini user-global config files.
<skill-base-dir>/../langfuse/scripts/run_stop_hook.sh — populates the env for the Claude Code Stop-hook tracer.

---name: bao-vaultdescription: OpenBao/Vault credential seeding and management scripts---# Bao Vault Infrastructure SkillNon-user-invocable infrastructure skill for OpenBao/Vault credential seeding and management.## Scripts### scripts/bao_seed.pySeeds OpenBao with agent API keys and secrets from agents.yaml configuration. Reads any string-valued key in `.secrets.yaml` and writes it under the configured KV mount, so adding new credential names (e.g. `LANGFUSE_PUBLIC_KEY`) requires no code change — just add the key to `.secrets.yaml` and re-run.**Usage**:```bashpython3 "<skill-base-dir>/scripts/bao_seed.py" [options]```**Environment variables**:- `BAO_ADDR` — OpenBao server address- `BAO_TOKEN` — Root or privileged token for seeding- `BAO_SECRETS_FILE` — secrets YAML path (defaults to `.secrets.yaml` in the current project)- `AGENTS_YAML` — agent configuration path (defaults to `agents.yaml` in the current project)Both inputs can also be supplied with `--secrets-path` and `--agents-path`.The skill does not assume that the consumer contains an `agent-coordinator/`checkout.**Exit codes**: 0 = seeded successfully, 1 = error### scripts/langfuse_env.shResolves `LANGFUSE_PUBLIC_KEY`, `LANGFUSE_SECRET_KEY`, and `LANGFUSE_HOST` from OpenBao (preferring values already in the environment), computes `LANGFUSE_BASIC_AUTH = base64(public:secret)`, and emits four `export` lines on stdout. Designed to be sourced via `eval`:```basheval "$("<skill-base-dir>/scripts/langfuse_env.sh")"```Falls back silently when `BAO_ADDR` is unset or the keys are already populated, so it is safe to put in shell init or scripts.**Authentication**: prefers `BAO_TOKEN` if set, otherwise uses AppRole login via `BAO_ROLE_ID` + `BAO_SECRET_ID` (matches `bao_seed.py`).**Consumed by**:- `<skill-base-dir>/../langfuse/scripts/install-mcp.sh` — computes the literal Basic-auth token written into Codex / Gemini user-global config files.- `<skill-base-dir>/../langfuse/scripts/run_stop_hook.sh` — populates the env for the Claude Code Stop-hook tracer.

Frequently asked questions

Bao Vault