kyvault-ops SKILL.md skillA
kyvault-ops from webkubor/kyvault is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add webkubor/kyvault/kyvault-ops@v2.7.0Pins v2.7.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- webkubor/kyvault
- Path
SKILL.md- Versions recorded
- 13
- Latest version
- v2.7.0, committed Oct 26, 2026
- First version recorded
- Aug 11, 2026
- Size
- 6,506 bytes
- Repository stars
- 4
- License
- MIT
使用 kyvault (或快捷短命令 ky) 在本地与 GitLab 团队环境中端对端管理加密 API Key、服务器资产台账与多 Profile 凭证。支持 Claude、Codex、Gemini 与 Hermes 全自动读写与子进程安全注入。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 🛡️ Kyvault 密钥与资产台账端对端运维指南 (kyvault-ops) `kyvault` 是本地加密凭证台账与 Git 密文同步工具，面向开发者和本地 AI Agent。文件后端使用 AES-256-GCM；GitLab 同步、API 检查和升级会联网。早期 Auth Guard 读取公开 SSH `.pub` 派生 AES key，不验证私钥持有；远程 Agent 的逐条授权由实验性的 `ky broker`（OpenSSH forced-command）承担，主设备签名审批与自动轮换尚未实现。 ## 1. 核心操作命令 Agent (Claude / Codex / Gemini / Hermes) 在需要读取或管理密钥时，应直接执行原生命令（或快捷短命令 `ky`）： ```bash # 1. 查看密钥目录元信息（只出元信息与脱敏 last4，绝不暴露明文） kyvault list # 或 ky list # 2. 注入子进程环境变量执行命令（首选，零明文回显，不落盘） kyvault run --env TOKEN=secret://platform/key_name -- <command> # 3. 读取特定密钥的明文（仅在必须写配置文件等无法注入的环境使用） kyvault get secret://platform/key_name # 4. 写入/更新一个密钥（支持从 stdin 读避免暴露在 ps 进程列表） kyvault set secret://platform/key_name "<value>" --kind "API Key" echo "<value>" | kyvault set secret://platform/key_name - # 4b. 长密钥 / 多行 PEM 走文件，别塞 argv（明文会进 ps 与 shell history） kyvault set secret://platform/key_name - --file /path/to/key.pem --kind "Private Key" # 有 BEGIN 没配对的 END 会被拒收（看着像被截断）；确认无误再加 --force # 5. 校验密钥有效性与余额（验证通过自动同步审计元信息至 meta.json） kyvault check <platform> <key_name> kyvault check email <key_name> # 邮箱授权码 / 应用专用密码：IMAP 登录验证（不是 HTTP API） …
Read the whole file at its exact version.
How to install
mdr add webkubor/kyvault/kyvault-ops@sha256:2a7de5cbffac4595The line at the top of this page pins the label v2.7.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_bb5jjeqjlj3t233y)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 13 versions of this file, between Aug 11, 2026 and Oct 26, 2026, about one every 6 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2.7.0 latest | 2026-10-26 | 2bb1d80 | 6,506 B | A | view · diff |
| v2.6.0 | 2026-10-26 | e1eff0b | 6,506 B | A | view · diff |
| v2.6.0 | 2026-10-26 | 81422d7 | 6,095 B | A | view · diff |
| v2.6.0 | 2026-10-19 | bdac79b | 4,839 B | A | view · diff |
| v2.4.1 | 2026-09-23 | 87dddc7 | 4,565 B | A | view · diff |
| v2.4.0 | 2026-09-23 | e1b8e66 | 4,565 B | A | view · diff |
| v2.4.0 | 2026-09-23 | aeae549 | 4,591 B | A | view · diff |
| v1.4.0 | 2026-09-18 | cd042b6 | 7,685 B | B | view · diff |
| v1.3.0 | 2026-09-10 | 16a511a | 5,654 B | B | view · diff |
| v1.3.0 | 2026-08-11 | 346b880 | 5,220 B | A | view · diff |
| v1.3.0 | 2026-08-11 | d451ed5 | 5,128 B | A | view · diff |
| v1.3.0 | 2026-08-11 | 4f1d2c6 | 5,052 B | A | view · diff |
| v1.3.0 | 2026-08-11 | b4d9b07 | 5,006 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (6506 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
webkubor/kyvault · 4 stars · license MIT · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_bb5jjeqjlj3t233y GET https://markdownregistry.com/api/v1/resolve?ref=webkubor/kyvault/kyvault-ops GET https://markdownregistry.com/api/v1/blob/2a7de5cbffac459506c783dafba7f37419586ba4fbe15803b8c45d92fe20d053
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from webkubor/kyvault
Every file in webkubor/kyvault