An encrypted local vault for storing API keys, server credentials, tokens, and device records. Agents can list, read, update, delete, and inject these secrets into local or CI commands.

Use it to manage API keys, server passwords and SSH keys, service tokens, server costs, providers, and other sensitive assets. It can provide selected secrets as environment variables when running a command.

It keeps sensitive values out of source code and reduces the need to copy them into shell commands or configuration files. It also gives server and credential records consistent paths.

kyvault-ops — Skill for Claude Code and Codex by webkubor

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add webkubor/kyvault --skill assets

Clone the repo

git clone --depth 1 https://github.com/webkubor/kyvault

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/webkubor/kyvault/assets/github.svg)](https://agentmods.dev/skills/webkubor/kyvault/assets)

Your own site

<a href="https://agentmods.dev/skills/webkubor/kyvault/assets"><img src="https://agentmods.dev/badge/skills/webkubor/kyvault/assets/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/webkubor/kyvault/assets"><img src="https://agentmods.dev/badge/skills/webkubor/kyvault/assets.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 52 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,195 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00052	$0.01195
Opus 5	$0.00026	$0.00598
Sonnet 5	$0.00010	$0.00239
Haiku 4.5	$0.00005	$0.00120

Measured yesterday against content hash cd12baf0fd5a, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

kyvault-ops scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

rust/assets/SKILL.md · 73 lines

How it starts

The opening of the file, as written. The whole thing — 73 lines — stays where its author put it; the contents beside it link to each section on GitHub.

🛡️ Kyvault 密钥与资产台账端对端运维指南 (kyvault-ops)

kyvault 是开发者的本地加密资产管理器。通过平台命令 cs kyvault（别名 cs secrets）在本地加密 D1 数据库中安全存取敏感资产。

1. 核心操作命令

Agent (Claude / Codex / Gemini) 在需要读取或管理密钥时，应直接执行以下命令：

# 1. 查看密钥目录元信息（不暴露明文）
cs secrets list

# 2. 读取特定密钥的明文
cs secrets get secret://<path/to/key>

# 3. 往密钥库中写入/更新一个密钥
cs secrets set secret://<path/to/key> "<value>"

# 4. 删除指定密钥
cs secrets delete secret://<path/to/key>

# 5. 在环境变量中注入特定密钥并执行命令 (生产部署/自动化最推荐)
cs secrets run --env CLOUDFLARE_API_TOKEN=secret://cloudflare/api-token -- <command>

2. 统一资产与台账命名规范 (SSOT Schema)

A. 服务器台账 (Server Ledger)

路径格式：secret://server/<hostname_or_project>/<field>

secret://server/<hostname>/ip ➡️ 服务器公网 IP
secret://server/<hostname>/root-password ➡️ root 密码
secret://server/<hostname>/ssh-key ➡️ SSH 私钥 (如有)
secret://server/<hostname>/cost ➡️ 服务器月度租金成本 (如 99元/月)
secret://server/<hostname>/provider ➡️ 服务商 (如腾讯云/Cloudflare/阿里云)

B. CLI 客户端多 Token 维护 (CLI Multi-Tokens)

路径格式：secret://cli/<cli_name>/<profile_name>

secret://cli/feishu/work ➡️ 飞书 CLI 工作/企业账号 Token
secret://cli/feishu/personal ➡️ 飞书 CLI 个人账号 Token
secret://cli/gitlab/personal ➡️ GitLab 个人访问令牌 (PAT)
secret://cli/github/personal ➡️ GitHub 个人访问令牌 (PAT)
secret://cli/cloudflare/personal ➡️ Cloudflare API 令牌
secret://cli/studio-cli/webkubor ➡️ studio-cli 主账号的登录凭证 (JWT 或 API Key)
secret://cli/studio-cli/test-user ➡️ studio-cli 测试账号凭证

C. 微信与第三方支付配置 (Platform Secrets)

路径格式：secret://wechat/<app>/<field> 或 secret://creem/<field>

secret://wechat/miniapp-jianshanghua-appid ➡️ 笺上花小程序 AppID
secret://wechat/miniapp-jianshanghua-secret ➡️ 笺上花小程序 AppSecret
secret://creem/api-key ➡️ Creem API 秘钥

3. Agent 行为守则 (Rule of Thumb)

绝对禁止硬编码：Agent 严禁将 any API 密钥、密码、服务器 IP 写入代码文件或 Git 提交。
自动化自检：如果运行测试或部署脚本时缺失环境变量，Agent 应自动调用 cs secrets list 寻找匹配的密钥，解密后注入环境变量中运行。
时效更新与覆写（🚨 重点放过往失效 Key）：一旦检测到密钥库中的某个 Key 失效（如调用报错 401、Token 过期或验证失败），Agent 必须立刻主动覆写（Overwrite）修改，严禁因为保守而在密钥失效时继续保留旧密钥（“只做加法不改失效”属于严重违规行为）。对于失效 Key 必须通过 cs secrets set 写入最新值，或引导用户轮换。

Read the full file on GitHub · 73 lines

Files

What ships with it

2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 73 lines · 52 tokens per session scan A cd12baf0fd5a

Subscribe to this mod's changes

kyvault-ops is a skill published in the GitHub repository webkubor/kyvault (12 stars, last pushed yesterday), licensed MIT. It adds 52 tokens to every session and 1,195 once invoked, about $0.0003 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-11.

API-key Security aes-256-gcm agent-skills ai-agent cloudflare d1

cloudflare

Use when working on Cloudflare's edge platform — wrangler.jsonc bindings, choosing between D1/KV/R2/Durable Objects/Queues, deploying a Worker or SPA via Static Assets, or designing around a Workers runtime limit. NOT generic CI/release (that is deployment), NOT Next.js framework wiring (that is nextjs), NOT DNS…

ericrisco/rsc-harness · 86 tokens

kyvault-ops