Keychain Skill

Keychain is an agent skill for Codex and other AI coding assistants that stores small secrets and reusable configuration values in the macOS Keychain.

It is useful when an AI workflow needs an API token, password, account-specific setting, or other value across sessions, but you do not want that value in project files, shell history, generated documentation, or chat output.

Installing Keychain

Install the skill with npx:

npx skills add https://github.com/Gucky/KeychainSkill --skill keychain

To install it globally for Codex:

npx skills add https://github.com/Gucky/KeychainSkill --skill keychain --agent codex --global

For a specific agent:

npx skills add https://github.com/Gucky/KeychainSkill --skill keychain --agent claude-code

For all supported agents:

npx skills add https://github.com/Gucky/KeychainSkill --skill keychain --agent '*'

If npx is not available, install Node.js first. On macOS with Homebrew:

brew install node

Using Keychain

In Codex, trigger the skill directly:

$keychain

You can also ask naturally:

Use the Keychain skill to store my GitHub token as github_token.

or:

Use the Keychain skill to check whether github_token exists.

The simple item-name interaction is intentionally small:

• To store a value, provide an item name and the value.
• To read a value, provide the item name.
• Normal read checks show safe metadata, not the secret itself.
• Raw values should only be exposed when you explicitly ask for that.

Internally, each item is stored as a macOS generic password under the fixed service keychain_skill. The user-facing item name is stored as the Keychain account, so github_token becomes service=keychain_skill, account=github_token.

The skill also supports explicit service/account storage:

./scripts/keychain-write-account.sh "example.com" "[email protected]" "TOKEN"
./scripts/keychain-read-account.sh "example.com" "[email protected]"

Safety Model

The skill is designed to avoid accidental secret disclosure:

• Secrets are stored in the macOS Keychain, not in this repository.
• The fixed Keychain service is keychain_skill; item names are stored as Keychain accounts.
• Advanced service/account entries use the service and account values provided by the caller.
• Normal reads report whether an item exists and how long the value is.
• Secret values are not printed by default.
• Raw values are meant for controlled command use, not for chat transcripts or generated files.

Requirements

• macOS
• Node.js for npx
• An AI coding assistant that supports agent skills

License

Keychain was created by Wolfgang Muhsal. It is available under the MIT License, which permits commercial use, modification, distribution, and private use.