Skip to content
cccskills
FreePublished on GitHub

ls-keepass-secret-references

Use when validating logical secret-ID maps, config, and reference syntax for a KeePassXC integration; output is redacted and the fake backend is test-only.

The English summary is being prepared. Showing the original description.

See how to install

Files included (31)

  • SKILL.md4.1 KB
  • docs/agent-usage-patterns.md711 B
  • docs/architecture.md778 B
  • docs/command-reference.md1.4 KB
  • docs/config-resolution.md517 B
  • docs/global-vs-repo-local-scope.md443 B
  • docs/keepassxc-installation-versioning.md452 B
  • docs/migration-from-v1.md360 B
  • docs/portable-vault-files.md357 B
  • docs/reference-format.md370 B
  • docs/security-threat-model.md596 B
  • docs/source-ledger.md3.1 KB
  • docs/troubleshooting.md839 B
  • docs/update-procedure.md414 B
  • docs/vault-backends.md780 B
  • docs/version-ledger.md414 B
  • examples/batch-ensure.yaml288 B
  • examples/env-injection.sh186 B
  • examples/global-config.yaml278 B
  • examples/map.yaml571 B
  • examples/references.txt154 B
  • examples/repo-config.yaml253 B
  • schemas/batch.schema.json805 B
  • schemas/command-result.schema.json667 B
  • schemas/config.schema.json559 B
  • schemas/map.schema.json344 B
  • schemas/reference.schema.json545 B
  • scripts/fake_vault_backend.py4.9 KB
  • scripts/localsetup_secrets_support.py15.1 KB
  • scripts/localsetup_secrets.py20.7 KB
  • scripts/verify_keepassxc.py2.9 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

KeePass secret mappings

Use this skill to validate non-secret logical-ID metadata and reference syntax. It does not resolve, display, create, rotate, update, delete, or otherwise access real KeePassXC entries.

Supported commands

Primary validation commands:

python3 scripts/localsetup_secrets.py map-validate --map examples/map.yaml
python3 scripts/localsetup_secrets.py reference '{{secret:mail.box03.example.admin:password}}'

Capability check:

python3 scripts/verify_keepassxc.py --format json

The CLI emits JSON envelopes by default:

{
  "ok": true,
  "command": "map-validate",
  "data": {},
  "warnings": [],
  "errors": [],
  "sources": [],
  "sensitive": false,
  "redactions": []
}

Use --format human only for interactive display. Diagnostics are redacted. Protected values require --show-sensitive.

The default keepassxc backend preserves existing configuration and may check the CLI version. When keepassxc-cli is unavailable it reports missing_backend; otherwise it refuses every vault operation with interactive_backend_required. fake exists only for deterministic tests and examples; it is not a secret store.

Logical IDs

Canonical IDs are lowercase and may contain letters, digits, dots, underscores, and hyphens:

mail.box03.example.admin
postgres.box03.app1
api.box03.stripe.live

Aliases, including email-like aliases, may be declared in map files. Ambiguous aliases fail clearly.

References

Supported forms:

Secret ID: mail.box03.example.admin
{{secret:mail.box03.example.admin:password}}
secret://localsetup/repo/default/mail.box03.example.admin#field=password

See docs/reference-format.md.

Config and Maps

Resolution order:

  1. CLI flags.
  2. LOCALSETUP_SECRETS_* environment variables.
  3. Repo-local .localsetup/secrets/config.yaml and map.
  4. Legacy secrets/keepass-config.yaml plus secrets/*-secrets-map.yaml.
  5. Global ~/.config/localsetup/secrets/config.yaml and ~/.local/share/localsetup/secrets/maps/default.yaml.

Config and map files may contain metadata, entry paths, usernames, URLs, and aliases. They must not contain passwords, tokens, key material, or passphrases.

Examples live in examples/. Contract schemas live in schemas/.

Backends

  • keepassxc: the default capability guard. It checks that keepassxc-cli is present for diagnostics but never opens a vault or runs read/write operations.
  • fake: deterministic test and example backend for placeholder data only. It must not be used as a secret store.
  • PyKeePass: future optional backend only; not installed or required by this skill.

Safety Rules

  • Never put secret values in tracked files.
  • Keep .kdbx, keyfiles, and .env files out of Git.
  • Treat interactive_backend_required as an explicit refusal, not a request to bypass the vault boundary.
  • Use the fake backend only in isolated tests and examples.
  • Do not open, create, or inspect real vaults during tests.

Documentation

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

Guide accessibility reviews for UI, documents, and workflows. Use for WCAG-oriented audits, keyboard review, semantics, contrast, and remediation planning.

The English summary is being prepared. Showing the original description.

CruxExperts/LocalSetup6Updated Oct 22, 2026

Use when choosing a LocalSetup Agent-* lane for exploration, research, bounded implementation, or review. Consult the static capability matrix; do not probe account or network availability.

The English summary is being prepared. Showing the original description.

CruxExperts/LocalSetup6Updated Oct 22, 2026

Guide agent email inbox workflows with prompt-injection defenses. Use for inbound email processing, webhooks, routing, and safety review.

The English summary is being prepared. Showing the original description.

CruxExperts/LocalSetup6Updated Oct 22, 2026

Navigate and understand codebases using agentlens hierarchical documentation. Use when exploring new projects, finding modules, locating symbols in large files, finding TODOs/warnings, or understanding code structure.

The English summary is being prepared. Showing the original description.

CruxExperts/LocalSetup6Updated Oct 22, 2026

Use for Agent Q signed encrypted file-drop or mail ship and ingest, private registry v2 setup, queue status, and transport maintenance.

The English summary is being prepared. Showing the original description.

CruxExperts/LocalSetup6Updated Oct 22, 2026

Inventory wrapper for the alirezarezvani Claude skills bundle. Use when triaging its broad skill catalog and large script surface before any targeted import.

The English summary is being prepared. Showing the original description.

CruxExperts/LocalSetup6Updated Oct 22, 2026

See all skills by CruxExperts

Report a problem with this skill