How do I install the Cboone Cboone Cc Plugins Handle Secrets skill?

Run npx skillmds@latest add tomevault-io/cboone-cboone-cc-plugins-handle-secrets in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Cboone Cboone Cc Plugins Handle Secrets skill do?

Handle Secrets It is listed under Coding & Dev Tools on SkillMD.

Is Cboone Cboone Cc Plugins Handle Secrets safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Cboone Cboone Cc Plugins Handle Secrets?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Cboone Cboone Cc Plugins Handle Secrets free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Cboone Cboone Cc Plugins Handle Secrets?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Cboone Cboone Cc Plugins Handle Secrets by tomevault-io

Name: Cboone Cboone Cc Plugins Handle Secrets
Author: tomevault-io

File contents

Handle Secrets

Best practices for handling secrets that users pass to your CLI tool (API keys, tokens, passwords), not secrets used during development.

Core Principles

Never accept secrets as command-line arguments - Arguments are visible via ps aux, recorded in shell history, and captured by audit logs
Make the secure path the default - Users who do nothing special should get the safest behavior
Separate config from credentials - Non-sensitive settings and secret material belong in different files
Mask secrets in all output - Debug logs, error messages, HTTP traces, and verbose output must redact secret values
Warn loudly about insecure behavior - If users opt into something dangerous, tell them explicitly

Security Hierarchy (Safest to Most Dangerous)

Method	Safety	Use when
OS keychain / credential helper	Safest	Persistent storage for interactive users
Secret references (`op://`, vault URIs)	Safe	Storing pointers instead of secrets
Stdin / pipes / file descriptors	Safe	Automation and scripting
Interactive TTY prompt	Safe	Human users at a terminal
Config files (0600 permissions)	Acceptable	Persistent storage without keychain
Environment variables	Acceptable	CI/CD pipelines and containers
Command-line arguments	Never	-

Workflow

Quick reviews: Check against references/checklist.md
Choosing an input method: Read references/security-hierarchy.md
Designing credential flows: Read references/design-patterns.md
Avoiding known pitfalls: Read references/anti-patterns.md
Language-specific code: Read references/language-libraries.md

Reference Navigation

Quick reviews (default):

references/checklist.md - Condensed, actionable rules

Deep dives by topic:

references/security-hierarchy.md - Ranked input methods with attack surfaces and mitigations
references/design-patterns.md - Credential fallback chains, OAuth device flow, token hygiene, masking
references/anti-patterns.md - Real CVEs and incidents from insecure secret handling
references/language-libraries.md - Rust, Go, Python, Node.js, Ruby libraries and code patterns

Credential Resolution Fallback Chain

Tools should resolve credentials in this order:

Environment variable (for CI/CD)
Credential helper / OS keychain (for persistent storage)
Config file with 0600 permissions (fallback)
Interactive TTY prompt (for humans)

Never fall through to accepting --password <value> as an argument.

Sources

Building CLI tools that handle user secrets responsibly - Mac Chaffee
GitHub CLI, Docker, AWS CLI, kubectl, and 1Password CLI implementations

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: cboone-cboone-cc-plugins-handle-secretsdescription: Handle Secrets---# Handle SecretsBest practices for handling secrets that **users pass to your CLI tool** (API keys, tokens, passwords), not secrets used during development.## Core Principles1. **Never accept secrets as command-line arguments** - Arguments are visible via `ps aux`, recorded in shell history, and captured by audit logs1. **Make the secure path the default** - Users who do nothing special should get the safest behavior1. **Separate config from credentials** - Non-sensitive settings and secret material belong in different files1. **Mask secrets in all output** - Debug logs, error messages, HTTP traces, and verbose output must redact secret values1. **Warn loudly about insecure behavior** - If users opt into something dangerous, tell them explicitly## Security Hierarchy (Safest to Most Dangerous)| Method | Safety | Use when || --------------------------------------- | ---------- | ---------------------------------------- || OS keychain / credential helper | Safest | Persistent storage for interactive users || Secret references (`op://`, vault URIs) | Safe | Storing pointers instead of secrets || Stdin / pipes / file descriptors | Safe | Automation and scripting || Interactive TTY prompt | Safe | Human users at a terminal || Config files (0600 permissions) | Acceptable | Persistent storage without keychain || Environment variables | Acceptable | CI/CD pipelines and containers || Command-line arguments | **Never** | - |## Workflow1. **Quick reviews:** Check against `references/checklist.md`1. **Choosing an input method:** Read `references/security-hierarchy.md`1. **Designing credential flows:** Read `references/design-patterns.md`1. **Avoiding known pitfalls:** Read `references/anti-patterns.md`1. **Language-specific code:** Read `references/language-libraries.md`## Reference Navigation**Quick reviews (default):**- `references/checklist.md` - Condensed, actionable rules**Deep dives by topic:**- `references/security-hierarchy.md` - Ranked input methods with attack surfaces and mitigations- `references/design-patterns.md` - Credential fallback chains, OAuth device flow, token hygiene, masking- `references/anti-patterns.md` - Real CVEs and incidents from insecure secret handling- `references/language-libraries.md` - Rust, Go, Python, Node.js, Ruby libraries and code patterns## Credential Resolution Fallback ChainTools should resolve credentials in this order:1. Environment variable (for CI/CD)1. Credential helper / OS keychain (for persistent storage)1. Config file with 0600 permissions (fallback)1. Interactive TTY prompt (for humans)Never fall through to accepting `--password <value>` as an argument.## Sources- [Building CLI tools that handle user secrets responsibly](https://www.macchaffee.com/blog/2025/cli-secret-handling/) - Mac Chaffee- GitHub CLI, Docker, AWS CLI, kubectl, and 1Password CLI implementations---> Converted and distributed by [TomeVault](https://tomevault.io/claim/cboone) — claim your Tome and manage your conversions.

Frequently asked questions

Cboone Cboone Cc Plugins Handle Secrets