Agent Skills › YaoApp/yao › yao-secret

yao-secret

GitHub

提供密钥管理功能，支持列出可用密钥和读取指定密钥值。用于安全获取API Key、Token等敏感配置，禁止硬编码凭证，确保敏感数据不被泄露。

tools/skills/yao-secret/SKILL.md YaoApp/yao

Trigger Scenarios

需要读取API密钥或Token 需要获取用户配置的敏感信息

Install

npx skills add YaoApp/yao --skill yao-secret -g -y

More Options

Non-standard path

npx skills add https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret -g -y

Use without installing

npx skills use YaoApp/yao@yao-secret

指定 Agent (Claude Code)

npx skills add YaoApp/yao --skill yao-secret -a claude-code -g -y

安装 repo 全部 skill

npx skills add YaoApp/yao --all -g -y

预览 repo 内 skill

npx skills add YaoApp/yao --list

SKILL.md

Frontmatter

{
    "name": "yao-secret",
    "description": "Secret management expert. ALWAYS invoke this skill when you need to read API keys, tokens, or other secrets configured by the user. Never hardcode credentials — use this skill to retrieve them securely."
}

Secret Tools

Two tools for accessing user-configured secrets, called via bash.

secret_list

List available secret names and descriptions. Does not return secret values — use secret_read for that.

tai tool secret_list '{}'

No parameters required. Returns secrets configured for the current assistant.

secret_read

Read a secret value by name. Returns the decrypted value for use in scripts.

tai tool secret_read '{"name": "GITHUB_TOKEN"}'
tai tool secret_read '{"name": "AWS_SECRET_KEY"}'

Parameter	Type	Required	Description
`name`	string	yes	Secret key name (e.g. `GITHUB_TOKEN`, `AWS_SECRET_KEY`)

Security: Never log, print, or expose the returned secret value in output visible to users.

Typical Workflow

secret_list — discover what secrets are available
secret_read — retrieve a specific secret by name
Use the value in API calls, git auth, etc.

Guidelines

Always call secret_list first to check if a required secret exists before reading
Never hardcode API keys or tokens — always use secret_read
Secret values are decrypted at read time; treat them as sensitive
If a secret is not found, prompt the user to configure it in their settings
All output is JSON