solo-secrets SKILL.md skillB
solo-secrets from fortunto2/solo-factory is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add fortunto2/solo-factory/solo-secrets@v1.0.0Pins v1.0.0 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- B, 16 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- fortunto2/solo-factory
- Path
skills/secrets/SKILL.md- Versions recorded
- 1
- Latest version
- v1.0.0, committed Nov 2, 2026
- Size
- 8,157 bytes
- Repository stars
- 18
- License
- MIT
Keep API keys, tokens and passwords out of repos, configs, argv and chat logs — store them in the OS keystore (macOS Keychain, Linux libsecret), track rotation, scan for plaintext and migrate it. Use when user says "куда положить токен", "где хранить ключ", "секрет", "пароль в конфиге", "api key", "store this token", ".env", "rotate the key", "ротация", "токен утёк", "scan for secrets", or a credential shows up in a file, a prompt or a tool output. Do NOT use for auth flows inside an app…
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# /secrets — credentials in the keystore, never in plain text
One CLI, `scripts/secret` (stdlib Python 3.10+, no install), and one registry of
**metadata only**. Values live in the OS keystore; everything a human or an agent sees
is masked to the first 4 characters and the length: `cfut…(45)`.
```bash
S=${CLAUDE_PLUGIN_ROOT:-.}/skills/secrets/scripts/secret # or copy the path; alias it
```
## When a secret appears — do this, in order
1. **Never echo it back.** Do not repeat, quote or "confirm" the value in a reply, a
commit, a file or a command line. Refer to it by name.
2. **Was it seen anywhere that keeps logs?** A chat, an agent transcript, a screenshot,
CI output, a ticket, a commit (even one later amended): it is **leaked**. Run
`secret leak <name> --where "<where>"` and tell the user to rotate it now.
Claude Code writes prompts to `~/.claude/projects/*/*.jsonl`; a blocked prompt is
still echoed there.
3. **Store it** from stdin, never argv: `pbpaste | secret set example-api-token --class api-scoped --used-in "<tool>"`
(or run `secret set <name>` for a hidden prompt). Shell history and `ps` both see argv.
…Read the whole file at its exact version.
How to install
mdr add fortunto2/solo-factory/solo-secrets@sha256:0197b2f6751979cbThe line at the top of this page pins the label v1.0.0, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_kfohktlsdj5b4t4d)
0 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 1 version of this file, committed on Nov 2, 2026.
Audit of the latest version
- fail: No instruction to read or print local credentials (matched: read of a Keychain)
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (8157 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Starting a new one? Use a template for SKILL.md on mdpantry, which passes every one of these checks and says what to change in it.
Source
fortunto2/solo-factory · 18 stars · license MIT · pushed 2026-11-08 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_kfohktlsdj5b4t4d GET https://markdownregistry.com/api/v1/resolve?ref=fortunto2/solo-factory/solo-secrets GET https://markdownregistry.com/api/v1/blob/0197b2f6751979cb4f54978c8b01ccb622f02cedc4baadd16f8026db06be5dc2
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.