store-secret

The user's message may contain sensitive credentials. Your task is to store any real ones in the session secret store — but this skill fires proactively and can misfire on a docs snippet, a redacted example, or a key-shaped string that is not a secret, so confirm there is a real secret before storing anything. ## Prerequisites This skill only works in a `cs` session. Check if `$CLAUDE_SESSION_NAME` environment variable exists: ```bash echo $CLAUDE_SESSION_NAME ``` If empty, inform the user that secrets storage requires a cs session and skip storage. Then warn that the credential is now sitting in the conversation history, suggest they store it themselves in a secure secret store (a password manager or the OS credential store) and rotate it if it is sensitive. NEVER write the value to a project file as a fallback. ## Process 1. **Identify secrets** in the message that triggered this skill, or in the earlier message the user is pointing at ("store that key I pasted"). Look for: - API keys (patterns like `sk-...`, `AKIA...`, `ghp_...`, `xox...`) - Passwords or passphrases - Tokens (JWT, Bearer tokens, access tokens) - Database credentials or connection strings - Any key=value pairs where the key contains: key, secret, password, token, auth, credential 2. **Skip placeholders** - Do NOT store obvious placeholders like: - `YOUR_API_KEY`, `<token>`, `xxx`, `***`, `[redacted]` - Example values from documentation If nothing survives this filter — every ...