credentials

Safe Credentials Protocol

Many skills require API keys or other credentials to function or to access higher rate limits. This skill defines the standard safe credentials protocol for verifying and prompting for these credentials without leaking sensitive keys into the agent context or the conversation history.

Safe Verification (No Leaks)

As soon as a skill that requires a credential or API key looks relevant to the user's request, you MUST immediately verify if the credential is present in the .env file (typically located in your home directory ~/.env or the project root) — before doing any other work for that skill.

CRITICAL: You must verify the presence of the credential without printing its value to the terminal or reading it into your context.

How to verify:

Use grep in quiet and suppress-errors mode (-sq) to check if the variable is defined in ~/.env. The -s flag ensures the command works cleanly even if ~/.env does not exist yet.

grep -sq "^CREDENTIAL_NAME=" ~/.env

Replace CREDENTIAL_NAME with the actual credential name required by the calling skill (e.g., ALPHAGENOME_API_KEY or USER_EMAIL).

• If the command succeeds (exit code 0), the credential is present. You can proceed.
• If the command fails (any non-zero exit code — whether the credential is missing or the .env file does not exist yet), the credential is missing. You MUST IMMEDIATELY stop and prompt the user to add it using the instructions in Prompting the User to Add Credentials before attempting to run any scripts or tools. Do not conclude the turn by simply stating that the key is missing.

[!CRITICAL] If verification fails (any non-zero exit code), you MUST NOT attempt to execute any tools or scripts from the calling skill, nor should you conclude the turn by simply reporting the missing key. You MUST IMMEDIATELY generate the appropriate terminal command from the templates below and prompt the user to run it. The template command will create the .env file if it does not already exist.