kyvault-ops SKILL.md skillA
kyvault-ops from webkubor/kyvault is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add webkubor/kyvault/kyvault-ops@v2.7.0Pins v2.7.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- webkubor/kyvault
- Path
rust/assets/SKILL.md- Versions recorded
- 9
- Latest version
- v2.7.0, committed Oct 26, 2026
- First version recorded
- Sep 10, 2026
- Size
- 5,045 bytes
- Repository stars
- 4
- License
- MIT
使用 kyvault (或快捷短命令 ky) 在本地与 GitLab 团队环境中端对端管理加密 API Key、服务器资产台账与多 Profile 凭证。支持 Claude、Codex、Gemini 与 Hermes 全自动读写与子进程安全注入。.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# 🛡️ Kyvault 密钥与资产台账端对端运维指南 (kyvault-ops) `kyvault` 是本地加密凭证台账与 Git 密文同步工具，面向开发者和本地 AI Agent。文件后端使用 AES-256-GCM；GitLab 同步、API 检查与升级会联网。早期 Auth Guard 读取公开 SSH `.pub` 文件派生 AES key，不验证私钥持有，不能作为有效的密库保护或远程 Agent 身份认证。逐条 Agent 授权由实验性的 `ky broker`（OpenSSH forced-command）承担，主设备签名审批与自动轮换尚未实现。 ## 1. 核心操作命令 Agent (Claude / Codex / Gemini / Hermes) 在需要读取或管理密钥时，应直接执行原生命令（或快捷短命令 `ky`）： ```bash # 1. 查看密钥目录元信息（只出元信息与脱敏 last4，绝不暴露明文） kyvault list # 或 ky list # 2. 注入子进程环境变量执行命令（首选，零明文回显，不落盘） kyvault run --env TOKEN=secret://platform/key_name -- <command> # 3. 读取特定密钥的明文（仅在必须写配置文件等无法注入的环境使用） kyvault get secret://platform/key_name # 4. 写入/更新一个密钥（支持从 stdin 读避免暴露在 ps 进程列表） kyvault set secret://platform/key_name "<value>" --kind "API Key" echo "<value>" | kyvault set secret://platform/key_name - # 5. 校验密钥有效性与余额（验证通过自动同步审计元信息至 meta.json） kyvault check <platform> <key_name> kyvault check email <key_name> # 邮箱授权码 / 应用专用密码：IMAP 登录验证（不是 HTTP API） # 6. 本地主密钥状态 kyvault master-key # 显示路径、权限与脱敏指纹 # master.key 是整库根凭据；不要复制到远程 Agent。旧 Auth Guard 的 SSH 公钥派生实现不提供私钥保护。 # 7. 旧版 Auth Guard 状态（默认禁止新建旧格式） …
Read the whole file at its exact version.
How to install
mdr add webkubor/kyvault/kyvault-ops@sha256:0ae53d66cfb1872fThe line at the top of this page pins the label v2.7.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_imrvbgo54hn4mmiw)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 9 versions of this file, between Sep 10, 2026 and Oct 26, 2026, about one every 6 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v2.7.0 latest | 2026-10-26 | 2bb1d80 | 5,045 B | A | view · diff |
| v2.6.0 | 2026-10-26 | e1eff0b | 5,045 B | A | view · diff |
| v2.6.0 | 2026-10-26 | 81422d7 | 4,634 B | A | view · diff |
| v2.6.0 | 2026-10-19 | bdac79b | 4,565 B | A | view · diff |
| v2.4.1 | 2026-09-23 | 87dddc7 | 4,565 B | A | view · diff |
| v2.4.0 | 2026-09-23 | e1b8e66 | 4,565 B | A | view · diff |
| v2.4.0 | 2026-09-23 | aeae549 | 4,591 B | A | view · diff |
| git:20260923.dcaf435 | 2026-09-23 | dcaf435 | 5,143 B | A | view · diff |
| git:20260910.27b9050 | 2026-09-10 | 27b9050 | 4,095 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5045 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
webkubor/kyvault · 4 stars · license MIT · pushed 2026-11-05 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_imrvbgo54hn4mmiw GET https://markdownregistry.com/api/v1/resolve?ref=webkubor/kyvault/kyvault-ops GET https://markdownregistry.com/api/v1/blob/0ae53d66cfb1872fa9015d9a5960ba08b47ac8a27b7e76f0d335f00d0cf7103f
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from webkubor/kyvault
Every file in webkubor/kyvault