cursor

A set of rules for using the keys command-line tool to manage stored secrets without printing their values. Secrets are sensitive credentials such as API keys and passwords.

In plain words
What is it for?
Use it to list secret metadata, copy a secret to the clipboard with automatic clearing, or inject one into a file or environment without revealing its plaintext.
Why use it?
It reduces the chance of exposing credentials in chat, command output, or saved files, while noting that it is not a security boundary against programs running as the same user.

Cursor rule

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add rules/kyzdes/keys-keeper-skill/cursor
Clone the repo
git clone --depth 1 https://github.com/kyzdes/keys-keeper-skill
Per session 2,096 This file is loaded in full into every session.
When invoked 2,096 The same file — it is already loaded in full.
Security scan B 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5 $0.02096 $0.02096
Opus 5 $0.01048 $0.01048
Sonnet 5 $0.00419 $0.00419
Haiku 4.5 $0.00210 $0.00210

Measured 2d ago against content hash 9b822e62ad9d, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade B, and why

cursor scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 2d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- Linux desktop also wants the keyring tool: `sudo apt install libsecret-tools`.
tests/fixtures/rules/cursor.mdc · 112 lines

How it starts

The opening of the file, as written. The whole thing — 112 lines — stays where its author put it; the contents beside it link to each section on GitHub.

keys-keeper

Storage CLI is keys (run which keys / Get-Command keys to find the install path; typically wherever pipx installed it). Run keys --help for the full surface.

This integration is a transcript-hygiene workflow, not an isolation boundary against arbitrary code running as the same OS user. Normal commands avoid returning plaintext in tool output, but clipboard and file sinks remain readable by a shell-capable agent.

CRITICAL: never expose secret values

You MUST NOT:

  • run keys reveal (this command exists for the human, not for you)
  • pipe keys output containing values into Edit/Write/Bash echo
  • ask the user to paste a secret value into chat (it lands in the transcript)

In compatibility mode you CAN use the following commands. They avoid printing plaintext during normal operation, but any destination that receives plaintext must be treated as exposed to other processes with access to that destination:

  • keys list / keys info NAME — metadata only, no values
  • keys copy NAME — value goes to clipboard with 30s auto-clear, never stdout
  • keys inject NAME --file PATH --as ENV — value goes directly to file
  • keys resolve PATH — placeholder substitution in file (writes back to the same path)
  • keys add NAME --from-clipboard / --from-file PATH / --stdin (when the user already piped)
  • keys ssh NAME — opens ssh session with resolved key (CLI manages tempfile with locked-down permissions: POSIX 0600 on macOS/Linux, icacls user-restricted ACL on Windows)
  • keys rm NAME (use --cascade if the entry is referenced by others)
  • keys edit NAME — change tags / note / non-secret fields (--field key=value)
  • keys audit --name X --since 7d / --op copy — search the audit log
  • keys sync status — sync mode + local/remote versions (metadata only, no values)
  • keys doctor — paths + keychain sync check, useful when a value is missing
  • keys quickstart — read-only getting-started (config dir, command tour, first-key walkthrough); shows no values

Read the full file on GitHub · 112 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 2d ago First seen · 112 lines · 2,096 tokens per session scan B 9b822e62ad9d

Subscribe to this mod's changes

cursor is a cursor rule published in the GitHub repository kyzdes/keys-keeper-skill (2 stars, last pushed 23d ago), licensed MIT. It adds 2,096 tokens to every session, about $0.0105 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.