Secrets Manager CLI for AI Sessions

What it does

Avoids pasting API keys directly into an AI chat session. Store secrets once in a secrets manager (Doppler or similar) and give the assistant only the variable name. Includes validations that reject an empty clipboard, a variable name pasted as if it were the value, or content that changed mid-flow, plus a transcript scanner and a .env file importer.

When to use it

• Setting up credentials for a project that uses an AI assistant in the dev environment
• Migrating an existing .env file into a centralized secrets manager
• Auditing past session transcripts to catch accidentally exposed secrets

Steps

1. Register each secret once in the chosen secrets manager
2. Set up the command that injects the secret into the environment without printing it
3. Validate the clipboard isn't empty and doesn't contain the variable name as its value
4. Confirm the value didn't change between copy and use within the flow
5. Run the transcript scanner to detect secrets pasted by mistake into history
6. Import and migrate any stray .env files into the central manager

The skill

---
name: secrets-manager-cli
description: Store API keys in a secrets manager once, then hand the AI assistant the variable name, never the value, with anti-mistake validations.
---

# Secrets Manager CLI

## When to use it
When working with an AI assistant in the terminal and you need to use API keys without ever pasting them directly into chat.

## Core principle
The secret lives once in the manager (Doppler or equivalent). The assistant only knows the variable name; the real value never appears in the conversation.

## Set command validations
Rejects an empty clipboard, rejects a variable name pasted as if it were the value, and detects if content changed between copy and use.

## Transcript scanner
Scans past session histories for secrets pasted in by mistake, so they can be rotated immediately.

## .env importer
Migrates stray project .env files into the central manager, leaving the local environment free of sensitive plain text.

## Safety rules
The real value of a secret is never shown in chat or shared logs. Any rotation or deletion of secrets requires explicit user confirmation. Never assume unverified secret values.

For Claude Code, save it as ~/.claude/skills/secrets-manager-cli/SKILL.md. In Cursor, ChatGPT or another assistant, paste it as project instructions.