How does Claude Vault prevent secrets from leaking?

It uses a self-destructing script pattern where secrets are read and used internally within a temporary shell script that is deleted immediately after execution, ensuring they never appear in the command history or session logs.

What file formats are supported for storing secrets?

The skill is format-agnostic and can parse various structures including .env, .json, .ini, and .yaml files typically stored in your local ~/.secrets/ directory.

What should I do if I've already leaked a secret in a log?

The skill provides helper commands like '/secrets scan' to find leaks and '/secrets redact' to permanently remove them from your session logs.

Where are my secrets stored?

Secrets are stored locally on your machine, usually in ~/.secrets/. Claude Vault does not upload your keys to any cloud service; it only manages how they are accessed locally.

Can I use this with common CLI tools like AWS or GitHub?

Yes, it includes specific patterns and examples for sourcing credentials for the AWS CLI, GitHub CLI, npm, and Jira, ensuring tokens remain in-process.

Claude Vault: Secure Secrets Manager

Name: Claude Vault: Secure Secrets Manager
Author: ellyseum

byellyseum

•

Security & Testing

Protects sensitive API keys and credentials by executing commands through self-destructing scripts that prevent leakage into session logs.

Claude Vault provides a robust framework for handling secrets within Claude Code sessions, ensuring that sensitive information like API tokens and access keys never appear in session logs or command history. By utilizing a 'self-destructing script' pattern, the skill reads credentials from local files, executes necessary API calls or CLI commands internally, and immediately deletes the temporary execution environment. This approach mitigates the risk of accidental exposure during debugging or log sharing, supporting various formats including .env, .json, .ini, and .yaml while providing built-in tools for log scanning and redaction.

Key Features

011 GitHub stars

02Supports multiple credential formats including JSON, YAML, .env, and INI

03Prevents secrets from appearing in Claude's session logs and command history

04Implements self-destructing shell scripts for secure, ephemeral execution

05Automates security audits and permission fixes for local secret storage

06Includes built-in tools for scanning and redacting leaked secrets from existing logs

Use Cases

01Safely calling external APIs (e.g., OpenAI, AWS, Stripe) during a Claude Code session

02Publishing packages to npm or GitHub without exposing authentication tokens in terminal history

03Identifying and redacting accidentally leaked credentials from development logs

What are Skills?·How to Install

Install with 🐟 Skill.Fish

npx skillfish add ellyseum/claude-vault secrets

For use in Claude.ai and ChatGPT

Download Skill