clud-secret git:20261022.93cf3a6A

Immutable. This exact content never changes and is served at /api/v1/blob/630d975f2be59164.

---
name: clud-secret
description: Acquire a password, token or SSH private key for an authorized operation using clud's masked native prompt and direct secret sinks. Use when a task needs credentials; never request or display their values in chat.
triggers:
  - When an authorized operation requires acquiring a password, token or SSH private key
---
<!-- managed-by: clud -->

Use `clud secret` to acquire credentials without seeing them. Identify the
host and purpose in `--label`, and choose the sink appropriate to the
already-authorized operation:

```bash
clud secret --label 'GitLab token for gitlab.example.com' --to-command glab auth login --hostname gitlab.example.com --stdin
clud secret --label 'SSH private key' --multiline --to-command ssh-add -
clud secret --label 'OpenRouter API key' --vault openrouter
clud secret --label 'SSH private key for this host' --multiline --to-file /chosen/private/key
```

The command reports `stored`, `failed`, or `cancelled` (exit 3). It suppresses
sink stdout and stderr because commands may echo their input. Verify success
with a command that reports authentication status without exposing the
credential. On cancellation, stop the authentication attempt. If no desktop
prompt is available, report that limitation; do not ask for the value in chat.

`clud-askpass` implements GIT_ASKPASS, SSH_ASKPASS and SUDO_ASKPASS. Configure
those variables only for the intended git/ssh/sudo operation. Do not invoke
the alias directly: its stdout is the authentication protocol for the calling
tool, and it refuses ordinary agent/tool callers.

Do not put credentials in command arguments, shell variables printed to the
transcript, or examples. If a real credential was already pasted in chat,
advise the user to rotate it. Prompting does not authorize a new login or an
unrelated external operation.

If implementing a credential-flow change, preserve focused RED -> GREEN
regression evidence for secrecy and the sink's behavior.