Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →matlab/matlab-secure-credentials
Store, retrieve, and pass credentials securely in MATLAB using the built-in MATLAB Vault (setSecret, getSecret, importSecrets, secretID) instead of hardcoding. Handles connections to any authenticated service: REST APIs, databases, cloud storage (S3/Azure/GCS), SFTP, and others. Covers API keys, tokens, passwords, SSH passphrases, CI/batch/scheduled jobs, and "keep credentials out of code" requests. Does NOT cover third-party secret managers (HashiCorp Vault, AWS Secrets Manager), OS-level key m
Passed 22 of 22 test cases with the skill, and 9 of 22 without it.
and 15 more in the full report
13 fixed9 passed either way0 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 13 test cases the skill fixed. Same model, same prompt, with and without the skill.
I need to update an existing vault entry named 'MyApiToken' in MATLAB because the key was rotated. I want a command that prompts for the new secret value interactively and updates the vault entry without throwing a key already exists error. What is the correct MATLAB call?
| Checked | Without skill | With skill |
|---|---|---|
| The response sets the Overwrite option to true in setSecret. | Missed | Passed |
| The response passes only the secret name as positional argument to setSecret. | Passed | Passed |
The instructions your model reads when the skill loads.
Handle API keys, tokens, passwords, and passphrases with the MATLAB Vault, an encrypted store built into MATLAB, instead of hardcoding them. This skill covers the credential — storing it, retrieving it, and passing it into a connection to any authenticated service.
matlab-analyze-data,
matlab-use-database).Pick the mechanism by how the credential is supplied, not by habit.
| Situation | Use | Not |
|---|---|---|
| Credential is stored and reused across sessions | setSecret once, then getSecret at use | Hardcoding; a hand-rolled config file |
| You need to load a set of credentials at once (interactive setup, or non-interactive / CI / headless / scheduled) | importSecrets to populate the vault from a secrets file, then getSecret; or, in CI, getenv for a runner-injected value | setSecret in a headless job — it is only supported interactively |
| A function accepts credentials from a caller | secretID (a reference to the secret, not its value) | Storing the value in a struct field or argument |
Credential is genuinely a process environment variable — a CI-injected secret, or a cloud SDK convention like AWS_ACCESS_KEY_ID | getenv — this is correct | Duplicating it into the vault for no reason |
The rule is don't hardcode secrets — not "never use environment variables." getenv is
the right tool when the secret is already a process env var; the vault is the right default
test cases passed, vs 9 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.