ops-credentials — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited ops-credentials (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
| Command | Output |
|---|---|
bin/ops-credentials | Human table — configured + missing per service |
bin/ops-credentials --json | JSON array, one entry per credential |
bin/ops-credentials --service stripe | Filter to one integration |
The bin script is the source of truth. It scans these sources in order and reports the FIRST hit per credential:
$STRIPE_SECRET_KEY, etc.)$OPS_DATA_DIR/preferences.json (.revenue.stripe.secret_key, etc., including doppler:KEY references that get resolved live)security find-generic-password -s <name> -w)dcli password <keyword> --output json)Values shorter than 12 chars print as •••; longer values print as first6•••last4.
When the user runs /ops:credentials:
bin/ops-credentials and present the output verbatim — it's already formatted for the user's terminal (compact mode for SSH/mobile, table layout otherwise).What would you like to do next?
[Configure a missing service — pick one to set up now]
[Re-audit a specific service]
[Export to JSON]
[Done]AskUserQuestion. For each pick, call the /ops:setup <service> skill.bin/ops-credentials --service <name>.bin/ops-credentials --json and write the result to /tmp/ops-credentials-audit-$(date +%s).json. Print the path.Claude Code's plugin settings UI cannot introspect external credential stores. If a user has STRIPE_SECRET_KEY in macOS Keychain or klaviyo_api_key in Doppler, the settings panel shows those fields as empty (because the value isn't stored in Claude Code's user-config). The user can't tell at a glance which integrations they've already wired up.
/ops:credentials solves that — one command, one table, complete picture of which integrations are ready to use vs which still need /ops:setup.
| Field | Value |
|---|---|
| Service name | Homey Pro |
| Category | Home Automation |
| Keys | HOMEY_LOCAL_URL, HOMEY_LOCAL_TOKEN, HOMEY_CLOUD_TOKEN, HOMEY_ID |
| Storage | $PREFS_PATH → .home_automation.homey_local_url, .homey_local_token, .homey_cloud_token, .homey_id |
| Required | HOMEY_LOCAL_URL, HOMEY_LOCAL_TOKEN |
| Optional | HOMEY_CLOUD_TOKEN (off-LAN fallback), HOMEY_ID (cloud API only) |
Rotation: Revoke the current token at https://my.homey.app/manager/tokens, generate a new one, then rerun /ops:setup --section home to save the replacement.
{service, label, configured, masked, source}, never the raw secret.When $SSH_CONNECTION / $SSH_CLIENT / $SSH_TTY is set or $OPS_MOBILE=1, the bin script auto-switches to compact one-line-per-cred format. Skill output should pass it through unchanged.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.