c-secrets — Claude Code skill: what it does, how to install
Enables coding agents to fetch credentials and generate passwords via 1Password and Bitwarden CLIs without exposing secrets in terminal logs.
npx skills add daxaur/openpaw --skill c-secrets -a claude-codeWhat c-secrets does
This skill guides assistants to query password managers using op (1Password CLI) or bw (Bitwarden CLI). The agent can list vault entries, read public attributes like usernames or URLs, and pull specific values such as an AWS Access Key ID.
Security is enforced by design. Passwords and tokens must never appear in terminal output. Instead, every secret value or newly generated password gets piped directly to pbcopy. The assistant outputs only a brief confirmation that data was placed on your clipboard.
Prerequisites are minimal but strict. You must have op or bw installed locally and signed in. If Bitwarden is locked, you need to run bw unlock --raw and export BW_SESSION before the agent can query records.
What it helps with
- copy vault passwords directly to clipboard without terminal leaks
- generate secure passwords using
oporbwcommands - retrieve non-sensitive fields like account logins and service URLs
- extract specific custom fields like AWS Access Key IDs
Example prompts for the agent
- Copy my GitHub password from 1Password
- Generate a 20-character password with symbols using Bitwarden
- Check my AWS item in 1Password and show the username
How to install c-secrets
1Skills CLI (Vercel)
npx skills add daxaur/openpaw --skill c-secrets -a claude-code2Manually: put the files in place
~/.claude/skills/c-secrets/SKILL.mdCopy the whole skill folder; for one project use .claude/skills/c-secrets/
1Skills CLI (Vercel)
npx skills add daxaur/openpaw --skill c-secrets -a codex2Manually: put the files in place
.agents/skills/c-secrets/SKILL.mdFor all projects use ~/.agents/skills/
1Skills CLI (Vercel)
npx skills add daxaur/openpaw --skill c-secrets -a cursor2Manually: put the files in place
.cursor/skills/c-secrets/SKILL.mdCursor also reads .agents/skills/ and .claude/skills/
1GitHub CLI
gh skill install daxaur/openpaw c-secrets2Manually: put the files in place
.github/skills/c-secrets/SKILL.md1Skills CLI (Vercel)
npx skills add daxaur/openpaw --skill c-secrets -a gemini-cli2Platform CLI
gemini skills install https://github.com/daxaur/openpaw --path skills/c-secretsManually: put the files in place
.devin/skills/c-secrets/SKILL.mdThe legacy .windsurf/skills/ path still works
Skills CLI (Vercel)
npx skills add daxaur/openpaw --skill c-secrets -a opencodeClaude.ai
Zip the folder and upload it in Settings → Capabilities → Skills
Step by step, with commands for each platform: How to install skills in Claude Code: five ways
Questions about c-secrets
How to install c-secrets in Claude Code?
Run npx skills add daxaur/openpaw --skill c-secrets -a claude-code or place the file directly into ~/.claude/skills/c-secrets/SKILL.md.
What does c-secrets do?
It configures AI assistants to retrieve credentials and create passwords via op or bw CLIs, piping all sensitive values directly to the clipboard.
Will the assistant print a password if explicitly requested?
No. The skill instructs the agent to ignore display requests for secrets and redirect the value to pbcopy instead.
Source text
SKILL.md · MIT
--- name: c-secrets description: Look up and manage secrets using 1Password CLI (`op`) or Bitwarden CLI (`bw`). Retrieve passwords, generate new passwords, and copy credentials to clipboard. CRITICAL: Never display passwords in plain text — always copy to clipboard. tags: [passwords, secrets, 1password, bitwarden, credentials, security] --- ## What This Skill Does Retrieves credentials and generates passwords using `op` (1Password CLI) or `bw` (Bitwarden CLI). All passwords are copied to clipboard — never printed to the terminal. ## CRITICAL RULE **NEVER display passwords, tokens, or secret values in plain text output.** Always use clipboard copy commands. This applies to every secret retrieval, no exceptions. ## CLI Tools ### 1Password (`op`) ```bash # Copy a password to clipboard (PREFERRED — never print) op item get "GitHub" --fields password | pbcopy # Look up an item op item get "GitHub" # List all items op item list # Generate a password (copy to clipboard) op generate-password --length 20 --symbols | pbcopy # Get a specific field op item get "AWS" --fields "Access Key ID" ``` ### Bitwarden (`bw`) ```bash # Unlock vault first (session token required) export BW_SESSION=$(bw unlock --raw) # Copy password to clipboard (PREFERRED) bw get password "GitHub" | pbcopy # Look up an item bw get item "GitHub" # Generate a password (copy to clipboard) bw generate --length 20 --special | pbcopy ``` ## Usage Guidelines 1. **Always pipe passwords to `pbcopy`** — confirm "Copied to clipboard" to the user instead of showing the value. 2. If the user asks to "show" or "display" a password, redirect: copy it to clipboard and inform them. 3. For lookups, show non-sensitive fields (username, URL, notes) but never the password itself. 4. If vault is locked, prompt the user to unlock it manually before proceeding. ## Notes - `op` requires 1Password app installed and CLI signed in: `op signin` - `bw` requires Bitwarden CLI installed and vault unlocked each session
© daxaur · MIT · daxaur/openpaw
