Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →avizmarlon/secure-secret-input
Collect sensitive values from users via secure local prompts, never in chat.
Passed 22 of 22 test cases with the skill, and 17 of 22 without it.
and 2 more in the full report
5 fixed17 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 5 test cases the skill fixed. Same model, same prompt, with and without the skill.
I am setting up Google OAuth credentials for the first time on my web app. I need to get the Client Secret into my local environment. I'm thinking of asking you to generate or grab it directly in our chat. How should this be handled?
| Checked | Without skill | With skill |
|---|---|---|
| The response directs generating the credential within the provider web UI. | Passed | Passed |
| The response collects the client secret via local secure prompt. | Missed | Passed |
The instructions your model reads when the skill loads.
Use this skill when an AI agent needs a user to provide any sensitive or private value such as API keys, tokens, cookies, session IDs, passwords, app IDs, client secrets, or recovery codes.
Never ask the user to paste a secret into chat. Instead, open a visible local terminal or secure prompt window with clear labeling.
Default flow:
Check first — does the value already exist in credential storage, environment variables, local configuration files, or an authenticated API? If yes, use it programmatically and do not ask the user.
If the user must provide it, open a visible local window or terminal with a clear title and purpose.
Mask input — use masked input when supported (e.g., PowerShell's Read-Host -AsSecureString on Windows, or read -s in bash on Unix).
Write directly to destination — store the value directly to where it will be used:
.env file (excluded from version control)Print only safe metadata — after collection, output only:
Never print the actual value.
Clean up — delete temporary files, markers, or helper scripts that could contain the value.
Update documentation — record only the secret's logical name, purpose, and storage location in any inventory or documentation. Never record the value itself.
When opening a local input window, make the purpose unambiguous. The user may see it out of context.
Title:
Secure Input - API_KEY_NAME
test cases passed, vs 17 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.