api-credentials — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited api-credentials (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
🚨 DEPRECATED: This skill is no longer needed for hosted skills environments.
New approach: Skills now read credentials directly from project knowledge files:
ANTHROPIC_API_KEY.txt, GOOGLE_API_KEY.txt, GITHUB_API_KEY.txt (recommended)API_CREDENTIALS.json (combined file)See updated skill documentation:
Legacy use only: This skill may still be useful for local development environments or backward compatibility.
⚠️ WARNING: This is a PERSONAL skill - DO NOT share or commit with actual credentials!
This skill provides secure storage and retrieval of API credentials for multiple providers. It serves as a dependency for other skills that need to invoke external APIs programmatically.
Skills that need to invoke APIs should reference this skill:
import sys
sys.path.append('/home/user/claude-skills/api-credentials/scripts')
from credentials import get_anthropic_api_key
try:
api_key = get_anthropic_api_key()
# Use api_key for Claude API calls
except ValueError as e:
print(f"Error: {e}")import sys
sys.path.append('/home/user/claude-skills/api-credentials/scripts')
from credentials import get_google_api_key
try:
api_key = get_google_api_key()
# Use api_key for Gemini API calls
except ValueError as e:
print(f"Error: {e}")import sys
sys.path.append('/home/user/claude-skills/api-credentials/scripts')
from credentials import get_github_api_key
try:
api_key = get_github_api_key()
# Use api_key for GitHub API calls
except ValueError as e:
print(f"Error: {e}")cp /home/user/claude-skills/api-credentials/assets/config.json.example \
/home/user/claude-skills/api-credentials/config.jsonconfig.json and add your API keys:{
"anthropic_api_key": "sk-ant-api03-...",
"google_api_key": "AIzaSy...",
"github_api_key": "ghp_..."
}.gitignore (already configured)Set environment variables for the providers you need:
# Anthropic Claude
export ANTHROPIC_API_KEY="sk-ant-api03-..."
# Google Gemini
export GOOGLE_API_KEY="AIzaSy..."
# GitHub
export GITHUB_TOKEN="ghp_..."
# or
export GITHUB_API_KEY="ghp_..."Add to your shell profile (~/.bashrc, ~/.zshrc) to persist.
Credential retrieval follows this priority for each provider:
config.json in the skill directory (highest priority)api-credentials/
├── SKILL.md # This file
├── config.json # YOUR credentials (gitignored)
├── scripts/
│ └── credentials.py # Credential retrieval module
└── assets/
└── config.json.example # Template for usersWhen credentials are not found, the module raises ValueError with clear guidance:
Skills should catch ValueError exceptions and handle appropriately.
get_anthropic_api_key() → str
get_google_api_key() → str
get_github_api_key() → str
get_api_key_masked(api_key) → str
verify_credential(provider) → bool
To support additional providers:
assets/config.json.examplescripts/credentials.py: def get_provider_api_key() -> str:
# Follow existing pattern with config file + env var
passverify_credential() mappingThis skill uses ~300 tokens when loaded but saves repeated credential management code across multiple skills that invoke external APIs. It provides a single, consistent pattern for all credential handling.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.