secrets SKILL.md skillA
secrets from phnx-labs/agi-cli is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add phnx-labs/agi-cli/secrets@git:20261101.7870f6aPins git:20261101.7870f6a in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- phnx-labs/agi-cli
- Path
skills/secrets/SKILL.md- Versions recorded
- 9
- Latest version
- git:20261101.7870f6a, committed Nov 1, 2026
- First version recorded
- Jul 13, 2026
- Size
- 12,326 bytes
- Repository stars
- 26
- License
- a license file GitHub does not identify
Manage named bundles of environment variables backed by the OS keychain (macOS Keychain, Linux libsecret, Windows Credential Manager). Create bundles, add secrets, generate passwords, and inject them into agent runs. Triggers on: 'API key', 'credentials', 'secrets bundle', 'inject env vars', '--secrets', 'keychain', 'credential manager'.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Secrets Store credentials in the OS keychain and inject them into agent runs. The engine is the standalone **`secrets` CLI** (`@phnx-labs/secrets-cli`); call it directly. `agents secrets` was removed, and agi-cli does not ship the engine. agents-cli's part is `agents run --secrets <bundle>`, which injects a bundle into the agent it launches. ## Install ```bash agents clis install secrets # or: npm i -g @phnx-labs/secrets-cli@0.1.8 # or: agents setup secrets ``` No extra environment variables. After install, `secrets --version` prints `0.1.8` (the pin in `cli/src/lib/secrets-cli.ts`). The macOS broker is `secrets _agent-run`, not `agents daemon`. Socket: `$SECRETS_HOME/.cache/helpers/secrets-agent/`. Store credentials in your OS keychain and inject them into agent runs. Nothing touches disk in plaintext — not even the bundle metadata. ## Platform support | Platform | Backend | Install | |----------|---------|---------| | macOS | Keychain | Built-in | | Linux (desktop) | GNOME Keyring (libsecret) | `sudo apt install libsecret-tools` | | Linux (headless/server) | Use `env:` refs | See below | | Windows | Credential Manager (primary) + encrypted-file fallback | Built-in | …
Read the whole file at its exact version.
How to install
mdr add phnx-labs/agi-cli/secrets@sha256:2a75f1345fc1d303The line at the top of this page pins the label git:20261101.7870f6a, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_sdq35eldsztjyrau)
4 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 9 versions of this file, between Jul 13, 2026 and Nov 1, 2026, about one every 14 days.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20261101.7870f6a latest | 2026-11-01 | 7870f6a | 12,326 B | A | view · diff |
| git:20261012.084dfac | 2026-10-12 | 084dfac | 12,322 B | A | view · diff |
| git:20260910.8c6903f | 2026-09-10 | 8c6903f | 12,484 B | A | view · diff |
| git:20260907.2dc6170 | 2026-09-07 | 2dc6170 | 11,907 B | A | view · diff |
| git:20260817.b121ee7 | 2026-08-17 | b121ee7 | 11,282 B | A | view · diff |
| git:20260817.dd9eac7 | 2026-08-17 | dd9eac7 | 11,392 B | A | view · diff |
| git:20260805.31e8173 | 2026-08-05 | 31e8173 | 10,810 B | A | view · diff |
| git:20260803.32720b8 | 2026-08-03 | 32720b8 | 9,723 B | A | view · diff |
| git:20260713.069323a | 2026-07-13 | 069323a | 8,471 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (12326 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
phnx-labs/agi-cli · 26 stars · license a license file GitHub does not identify · pushed 2026-11-07 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_sdq35eldsztjyrau GET https://markdownregistry.com/api/v1/resolve?ref=phnx-labs/agi-cli/secrets GET https://markdownregistry.com/api/v1/blob/2a75f1345fc1d303aca46b05d50bacd6cb62abb0ef0f63391e1e7b071d67c985
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.
More from phnx-labs/agi-cli
Every file in phnx-labs/agi-cli