Sign in to command-line tools through a browser or device verification code, then save the login to a keychain. Later commands can request the saved credentials by handle, an identifier, without exposing token contents in the conversation.
Log a CLI in with a browser/device-code flow (aws sso, gh, glab, gcloud, …) and save the result to the keychain so later commands can request it through execute.credentials.
Review the instructions the agent will receive before you install.
Nothing captures logins for you. Every login runs in a fresh temporary home and is saved
to the keychain with the script shipped with this skill. Never log in against the real
$HOME, and never treat a token or config already in $HOME as a usable login: only a
keychain handle is. Use the same explicit sandbox_id for the skill read, login,
and save-login commands so the temporary home and save script stay on one computer.
Make a fresh directory and start the login with execute(background:true) with every config
location pointed into it. Copy in any config the CLI needs first (for AWS, the
[profile …]/[sso-session …] blocks in .aws/config); everything under that
directory becomes the saved login.
d=$(mktemp -d) && echo "$d"
in_d() { env HOME="$d" XDG_CONFIG_HOME="$d/.config" XDG_DATA_HOME="$d/.local/share" XDG_STATE_HOME="$d/.local/state" XDG_CACHE_HOME="$d/.cache" "$@"; }
in_d aws sso login --profile work --use-device-code --no-browser
in_d gh auth login --hostname github.com --git-protocol https --web
in_d glab auth login --hostname gitlab.com --web
in_d gcloud auth login --no-launch-browser
Use the CLI's device-code mode (AWS needs --use-device-code); a browser flow only
completes on the same machine.
Relay the verification URL and code from the job output. Answer any prompt with
background action send_input. Use its watch or poll action with the returned
process_id; never stop the job while the person is approving.
When it exits successfully, save the directory with the script under the absolute directory the skill read reported:
node <skill dir>/scripts/save-login.mjs aws "$d" --label "work (123456789012)"
The script uploads only the files under that directory, removes the directory, and prints the credential handle. It also removes a directory that holds no usable login. Never remove the directory yourself; if the save fails, run the script again. Saving the same service again replaces that entry in place: its id, handle, owner and grants stay the same.
Use the login only by naming the handle in credentials on execute (including background:true), including to check that it works. The files are staged in a private home for
that command or job, and refreshes the CLI writes are saved back when it ends.
Never print token files or paste their contents into the conversation. If the login fails or expires, start again from step 1 with a new directory.
No reviews yet. Tell others what you thought.
No login needed. Share how it worked for you, ask a question, or note where it did not run.
No comments yet. Be the first to write one.
Help QM organization admins inspect settings, stored memory, conversations, files, and operational records across the organization. It also supports confirmed configuration changes and external user management, while keeping admin grant changes in the dashboard.
Carry out website tasks in a remote browser, including expense submissions, authorized orders, and retrieving data behind a login. Personal browser profiles preserve sign-ins, while users handle login and verification screens themselves.
Sign in to a cloud provider’s command-line tool using a verification URL and one-time code approved on the user’s device. Check installation and account identity, save the login, and run commands within that user’s permissions.
Help users discover and connect apps, then run available app tools through QM’s authenticated backend. It checks connection status, presents consent options, and keeps Composio project keys out of user-facing setup.
Connect supported work apps through browser consent without sharing passwords with the agent. The skill checks available connection methods, provides a single-use authorization link when appropriate, and guides personal Slack account linking.
Set up recurring agent work for issues, tickets, or small fixes. The skill tests one real item first, then defines a repeatable procedure, tracks work to prevent duplicates, and holds outputs for human review.