keepassxc-secretslisted

# keepassxc-secrets — secrets from KeePassXC without leaking them Agent-facing secrets live in a **separate database**, by default `~/.pass/agents.kdbx`. Its master password is stored in the system keyring (Secret Service on Linux, Keychain on macOS, Credential Manager on Windows) and, on Linux, cached in the kernel keyring, so the commands run without prompting. The user's main database stays out of reach — that is what bounds the blast radius. `kpsec` is a shell script (`kpsec.ps1` on Windows). No runtime beyond the shell. ## The one rule **Never print a secret and never call `keepassxc-cli` directly.** Its output goes straight into the transcript. `kpsec` resolves values inside its own process and hands them to the child through the environment — they never touch stdout or argv. Never: ```bash keepassxc-cli show ... -a Password # the value lands in the model context some-cli --password "$(...)" # the password is visible in /proc/*/cmdline export TOKEN=$(...) # the value sticks in history and logs ``` Instead: ```bash kpsec run -e TOKEN=kp://gitlab/api -- some-cli # secret only in the child's env kpsec check kp://gitlab/api # verify without revealing ``` `kpsec run` does not filter what the child prints. If a command is known to echo its credentials (debug output, verbose HTTP logs), do not run it under `kpsec run` in an agent session. ## Reference format ``` kp://<group>/<entry>[#<Attribute>] ``