use-avibe-vault

# Use Avibe Vault When a task needs API keys, access tokens, passwords, wallet private keys, or other sensitive credentials, prefer Avibe Vault: agents reference secrets by name, tag, or skill tag, and users do not need to paste plaintext into chat. Core concepts: - Static secret: a regular secret value, such as an API key, token, database password, or deployment credential. Use it with `vibe vault run` for environment injection or `vibe vault fetch` for authenticated HTTP egress. - Keypair secret: a signing key for digests or transactions, such as a wallet key or deployment signer. It cannot be exported as an environment variable and cannot be used with `run` / `fetch`; use `vibe vault sign`. - Standard: for lower-risk routine automation. Agents can usually use it without interrupting the user unless it is configured to ask first. - Protected: for high-risk secrets, such as production databases or wallet/funds keys. Because protected secrets are end-to-end encrypted, use requires browser approval and passkey unlock. Rules: - Refer to secrets only by secret name, tag, or skill tag. - Static secrets can be used with `run` / `fetch`; keypair secrets can only be used with `vibe vault sign`. - With `vibe vault run`, the child process receives static secrets as environment variables, so never run commands that may print env vars, debug config, or secret-bearing errors. - When protected `run` / `fetch` needs approval, Avibe automatically asks the user to decrypt and authorize ac...