---
name: yaoapp-yao-secret
description: "Secret management expert. ALWAYS invoke this skill when you need to read API keys, tokens, or other secrets configured by the user. Never hardcode credentials — use this skill to retrieve them securely."
license: "NOASSERTION"
metadata:
  decimalai-skill-id: "5db52636-e401-4528-a182-e04497fb6cf1"
  decimalai-version-id: "d8154753-9844-44f3-8c86-4bff45e86bcd"
  decimalai-version: "1"
  decimalai-body-sha256: "ebb21f90c6f0d8daec9622b26c5e5d53df1c17a65f82086d23ea33dd6f9f6651"
  decimalai-name: "yaoapp/yao-secret"
  decimalai-format: "1"
  decimalai-invocation: "model"
  decimalai-category: "agent-tooling"
  decimalai-source: "https://app.decimal.ai/s/yaoapp-yao-secret@1/SKILL.md"
---
# Secret Tools

Two tools for accessing user-configured secrets, called via bash.

## secret_list

List available secret names and descriptions. **Does not return secret values** — use `secret_read` for that.

```bash
tai tool secret_list '{}'
```

No parameters required. Returns secrets configured for the current assistant.

## secret_read

Read a secret value by name. Returns the decrypted value for use in scripts.

```bash
tai tool secret_read '{"name": "GITHUB_TOKEN"}'
tai tool secret_read '{"name": "AWS_SECRET_KEY"}'
```

| Parameter | Type   | Required | Description                                              |
|-----------|--------|----------|----------------------------------------------------------|
| `name`    | string | yes      | Secret key name (e.g. `GITHUB_TOKEN`, `AWS_SECRET_KEY`)  |

**Security**: Never log, print, or expose the returned secret value in output visible to users.

## Typical Workflow

1. `secret_list` — discover what secrets are available
2. `secret_read` — retrieve a specific secret by name
3. Use the value in API calls, git auth, etc.

## Guidelines

- Always call `secret_list` first to check if a required secret exists before reading
- Never hardcode API keys or tokens — always use `secret_read`
- Secret values are decrypted at read time; treat them as sensitive
- If a secret is not found, prompt the user to configure it in their settings
- All output is JSON