agent的本地密码库

概述

QWQ Local Password Vault

This skill provides a small, local-only credential vault for Windows. The vault root is the installed skill directory: secrets sits beside scripts.

Safety Rules

• Never write plaintext passwords, tokens, Secret Keys, or private keys into Markdown, source code, Git-tracked files, screenshots, or chat output.
• Never include secrets*.credential.clixml in an upload or package.
• Prefer copying a secret to the clipboard. Reveal a secret only when the user explicitly requests it.
• CLIXML encryption is tied to the current Windows user and machine. This is not a team password manager.

Files

<skill-root>
├─ SKILL.md
├─ agentsopenai.yaml
├─ scripts
│  ├─ Save-Secret.ps1
│  ├─ Get-Secret.ps1
│  ├─ List-Secrets.ps1
│  ├─ Remove-Secret.ps1
│  └─ Rotate-Secret.ps1
├─ secrets
│  └─ *.credential.clixml
└─ templatessecret-entry.template.md

The scripts use Windows DPAPI through PowerShell Export-Clixml secure strings. Run them from the skill root or use their absolute paths.

Save

cd <skill-root>
.scriptsSave-Secret.ps1 -Name "entry-name" -Url "https://example" -Username "username-or-access-key" -Notes "non-secret notes"

The script prompts for the secret with Read-Host -AsSecureString. Existing entries require -Force and an overwrite confirmation. The file is written to a temporary path and atomically replaced after the write succeeds.

List Metadata

.scriptsList-Secrets.ps1

This lists names, URLs, usernames, notes, and timestamps without decrypting or printing secret values.

Copy or Reveal

Copy without printing:

.scriptsGet-Secret.ps1 -Name "entry-name" -CopySecret

The clipboard is automatically cleared after 30 seconds if its contents have not changed. Use -ClearClipboardAfterSeconds to choose another delay. -CopySecret and -RevealSecret are mutually exclusive.

Reveal only after an explicit request:

.scriptsGet-Secret.ps1 -Name "entry-name" -RevealSecret

Rotate or Delete

Rotate an existing secret while preserving metadata by default:

.scriptsRotate-Secret.ps1 -Name "entry-name"

Delete an entry with confirmation:

.scriptsRemove-Secret.ps1 -Name "entry-name"

Update any separate non-secret inventory manually after renaming, rotating metadata, or deleting an entry. Do not put the secret value in that inventory.

Recovery Limits

Back up the encrypted files only for the same Windows user and machine. For migration or team sharing, use KeePassXC, Bitwarden, 1Password, or an organization-managed vault instead.