mac-keychain

# Mac Keychain Use this skill to operate on macOS Keychain generic password items. ## Scope - Support `exists`, `read-meta`, `set`, `update`, `read-secret`, `reveal-secret`, and `delete`. - Operate on generic password items only. - Stop if the request involves certificates, identities, private keys, or broad keychain administration. ## Runtime - Require `macOS`, `/usr/bin/security`, and `/bin/zsh`. - Use the bundled scripts for deterministic behavior. - Stop and explain the missing runtime dependency if the scripts cannot run as shipped. ## Operating Rules - Resolve the target with `service + account` before any write, delete, or secret read. - Default to the current user's `login` keychain. - Pass `--keychain` only when the target is not the default login keychain. - Keep caller attribution, approval prompts, and workflow policy in the caller. Do not model them inside this skill. - Keep the script interface narrow. Do not pass legacy caller-attribution or purpose flags. - Keep this skill thin. It should expose local Keychain operations, not orchestrate a larger secret-management workflow. ## Safety Model - Do not guess missing `service` or `account` for `set`, `update`, `read-secret`, `reveal-secret`, or `delete`. - Do not echo the incoming secret in `set` or `update`. - Use `read-secret` for downstream machine use after the caller has already decided that retrieval is allowed. - Use `reveal-secret` only when the user explicitly wants plaintext in visible output. Re...