secretslisted

# Secrets Skill Manage named bundles of environment variables backed by macOS Keychain via the `agents secrets` CLI. - **Bundle** — a named container for secrets (e.g. "production", "x.com") - **Secret** — a key-value pair inside a bundle - **Keychain** — the default store; values never touch disk in plaintext ## Discover the command surface from the CLI The subcommands and flags are maintained in the CLI, not here. Run `agents secrets --help` and `agents secrets <command> --help` for the current surface instead of guessing or trusting a stale table. The everyday flow: ```bash agents secrets create production agents secrets add production STRIPE_API_KEY # prompts; stored in Keychain agents secrets list agents run claude "ship it" --secrets production ``` What this skill adds beyond `--help` is the behavior you cannot derive from it: ## Remote bundles (other hosts) Browse and *use* bundles that live on another machine, over SSH. Hosts resolve through the `agents devices` registry, an ssh-config alias, or `user@host`. - **`bundle@host`** is the reference form for `agents run --secrets`; local and remote bundles mix freely in one run. - **Ephemeral.** Remote values cross over SSH and are injected into the run's env in memory — never written to this machine's keychain or disk. - **The remote unlocks with its own credentials.** A file-backed remote bundle reads headlessly via the remote's own `AGENTS_SECRETS_PASSPHRASE`; a keychain bundle on a macOS remote block