Iron Proxy Gateway for NanoClaw
nanocoai/nanoclaw
Installs or refreshes Iron Proxy and its Iron Control web console for NanoClaw, with a local Docker setup, database, credentials and a human approval bridge.
Lets the agent list and read the secrets a user has configured, such as API keys and tokens, through two tai tools instead of hardcoding credentials into code or commands.
Install Yao Secret Access
$ npx skills add YaoApp/yao --skill yao-secret -a claude-codeProject install by default; add -g for ~/.claude/skills/.
$ gh skill install YaoApp/yao yao-secret --agent claude-codeProject scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).
$ git clone --depth 1 https://github.com/YaoApp/yao.git skills-src && mkdir -p .claude/skills && cp -r skills-src/tools/skills/yao-secret .claude/skills/yao-secret && rm -rf skills-srcUse ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.
Claude Code skills documentation · loads skills from .claude/skills/
Install the "yao-secret" agent skill from https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret into .claude/skills/yao-secret/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-secret", then confirm the skill loads.Claude Code copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$skill-installer install https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secretType this inside Codex. $skill-installer <name> installs a curated skill from openai/skills. The installer writes to $CODEX_HOME/skills (default ~/.codex/skills). Restart Codex if the skill does not show up.
$ npx skills add YaoApp/yao --skill yao-secret -a codexProject install goes to .agents/skills/; add -g for ~/.codex/skills/.
$ gh skill install YaoApp/yao yao-secret --agent codexProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/YaoApp/yao.git skills-src && mkdir -p .agents/skills && cp -r skills-src/tools/skills/yao-secret .agents/skills/yao-secret && rm -rf skills-srcUse ~/.agents/skills/ instead of .agents/skills for a personal install.
Codex skills documentation · loads skills from .agents/skills/
Install the "yao-secret" agent skill from https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret into .agents/skills/yao-secret/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-secret", then confirm the skill loads.Codex copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add YaoApp/yao --skill yao-secret -a cursorProject install goes to .agents/skills/; add -g for ~/.cursor/skills/.
$ gh skill install YaoApp/yao yao-secret --agent cursorProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/YaoApp/yao.git skills-src && mkdir -p .cursor/skills && cp -r skills-src/tools/skills/yao-secret .cursor/skills/yao-secret && rm -rf skills-srcUse ~/.cursor/skills/ instead of .cursor/skills for a personal install.
Cursor skills documentation · loads skills from .cursor/skills/, .agents/skills/, .claude/skills/, .codex/skills/
Install the "yao-secret" agent skill from https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret into .cursor/skills/yao-secret/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-secret", then confirm the skill loads.Cursor copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gemini skills install https://github.com/YaoApp/yao.git --path tools/skills/yao-secret--scope user (default) or --scope workspace; --path is the subfolder of the repo that holds the skill; --consent skips the security confirmation prompt.
$ npx skills add YaoApp/yao --skill yao-secret -a gemini-cliProject install goes to .agents/skills/; add -g for ~/.gemini/skills/.
$ gh skill install YaoApp/yao yao-secret --agent gemini-cliProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/YaoApp/yao.git skills-src && mkdir -p .gemini/skills && cp -r skills-src/tools/skills/yao-secret .gemini/skills/yao-secret && rm -rf skills-srcUse ~/.gemini/skills/ instead of .gemini/skills for a personal install, then run /skills reload.
Gemini CLI skills documentation · loads skills from .gemini/skills/, .agents/skills/
Install the "yao-secret" agent skill from https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret into .gemini/skills/yao-secret/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-secret", then confirm the skill loads.Gemini CLI copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ gh skill install YaoApp/yao yao-secretInstalls for Copilot at project scope by default; add --scope user for a personal install. Preview a skill first with gh skill preview. Needs GitHub CLI 2.90.0 or later (public preview).
$ npx skills add YaoApp/yao --skill yao-secret -a github-copilotProject install goes to .agents/skills/; add -g for ~/.copilot/skills/.
$ git clone --depth 1 https://github.com/YaoApp/yao.git skills-src && mkdir -p .github/skills && cp -r skills-src/tools/skills/yao-secret .github/skills/yao-secret && rm -rf skills-srcUse ~/.copilot/skills/ instead of .github/skills for a personal install. Commit .github/skills so cloud agent and code review can use it.
GitHub Copilot skills documentation · loads skills from .github/skills/, .claude/skills/, .agents/skills/
Install the "yao-secret" agent skill from https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret into .github/skills/yao-secret/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-secret", then confirm the skill loads.GitHub Copilot copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
$ npx skills add YaoApp/yao --skill yao-secret -a opencodeOpenCode documents no install command of its own. Project install goes to .agents/skills/; add -g for ~/.config/opencode/skills/.
$ gh skill install YaoApp/yao yao-secret --agent opencodeProject scope by default (.agents/skills/); add --scope user for a personal install.
$ git clone --depth 1 https://github.com/YaoApp/yao.git skills-src && mkdir -p .opencode/skills && cp -r skills-src/tools/skills/yao-secret .opencode/skills/yao-secret && rm -rf skills-srcUse ~/.config/opencode/skills/ instead of .opencode/skills for a personal install.
OpenCode skills documentation · loads skills from .opencode/skills/, .claude/skills/, .agents/skills/
Install the "yao-secret" agent skill from https://github.com/YaoApp/yao/tree/main/tools/skills/yao-secret into .opencode/skills/yao-secret/ in this project. Copy the whole folder (SKILL.md and every file beside it), keep the folder name "yao-secret", then confirm the skill loads.OpenCode copies the folder itself, the same result as the manual copy. Check what it changed before you commit it.
Facts
- Skill name
yao-secret- GitHub stars
- 8.1k
- Token cost
- ~415 tokens
- SKILL.md length
- 160 words
- Files
- 1
- Skills in repo
- 14
- Repo updated
- First seen
- Licence
- Custom licence
At a glance
Lets the agent list and read the secrets a user has configured, such as API keys and tokens, through two tai tools instead of hardcoding credentials into code or commands.
- Works in 3 steps: secret_list — discover what secrets are… → secret_read — retrieve a specific secret… → Use the value in API calls, git auth, etc.
- A script needs an API key or token the user has already configured
- SKILL.md covers secret_list, secret_read, Typical Workflow and Guidelines
- Needs GITHUB_TOKEN and AWS_SECRET_KEY
What it does
This skill documents two tools called through bash with the tai command. secret_list returns the names and descriptions of the secrets configured for the current assistant but never their values. secret_read takes a name, such as GITHUB_TOKEN or AWS_SECRET_KEY, and returns the decrypted value for use in scripts. All output is JSON.
The intended order is to list first, confirm the needed secret exists, and only then read it and use it in API calls or git authentication. Credentials are never hardcoded, values are decrypted only at read time, and the agent is told not to log, print or expose a returned value anywhere users can see it. If a secret is missing, the agent asks the user to add it in their settings.
When your agent uses it
- A script needs an API key or token the user has already configured
- Checking which secrets are available before calling a service
- Authenticating git or an API call without writing credentials into files
Example prompts
- “Which secrets do I have configured? List the names only.”
- “Read GITHUB_TOKEN and use it to clone the private repo.”
- “Call the weather API with the key I stored as WEATHER_API_KEY, without printing it.”
Requirements
- The tai command-line tool
- Secrets configured in the assistant's settings
Workflow steps
3 steps, taken from the first numbered list in SKILL.md.
- secret_list — discover what secrets are available
- secret_read — retrieve a specific secret by name
- Use the value in API calls, git auth, etc.
What it can do on your machine
Read from SKILL.md and the folder at commit eea1e7e. It shows what the files ask for, not the result of running them.
Tool permissions
Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.
From allowed-tools in the SKILL.md frontmatter.
Runs code
No scripts in the folder and no shell commands in SKILL.md (its code samples are bash).
From the folder's file list and the shell code blocks in SKILL.md.
Network
No URLs in SKILL.md.
From URLs in SKILL.md, links to its own repository left out.
Credentials
Names these keys or tokens, usually read from environment variables:
GITHUB_TOKENAWS_SECRET_KEY
From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.
Context cost
Yao Secret Access loads about 415 tokens when it runs. Until then it costs about 53 tokens; SKILL.md has 160 words of instructions outside code blocks.
Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.
Safety
Auto-check passed
The automated check found no risky patterns in SKILL.md.
Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.
SKILL.md
Its licence (Custom licence) doesn't allow us to republish the file, so here is its outline and opening line. It has 160 words (~415 tokens).
“Two tools for accessing user-configured secrets, called via bash.”
- name
- yao-secret
Files
Just SKILL.md in tools/skills/yao-secret of YaoApp/yao.
Open the folder on GitHubat commit eea1e7e
Compare with similar skills
Yao Secret Access next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.
| Skill | Stars | Used in | Tokens | Auto-check | Licence | Repo updated |
|---|---|---|---|---|---|---|
| Yao Secret Access this skillYaoApp/yao | 8.1k | — | ~415 | Automated safety check: Pass | Custom licence | |
| Iron Proxy Gateway for NanoClawnanocoai/nanoclaw | 31k | — | ~4.6k | Automated safety check: Notes | MIT | |
| Secure GitHub Actionsvechain/x-app-template | 450 | — | ~1.2k | Automated safety check: Pass | MIT | |
| Get Env Var from InfisicalDevin-AXIS/iPolloWork | 6.8k | 1 repos | ~516 | Automated safety check: Pass | Custom licence | |
| Robotics Securityarpitg1304/robotics-agent-skills | 369 | — | ~7.8k | Automated safety check: Warn | Apache-2.0 | |
| Deploying Cloud Deception With Decoy Resourcesmukul975/Anthropic-Cybersecurity-Skills | 34k | — | ~2.8k | Automated safety check: Pass | Apache-2.0 |
Similar skills
Secure GitHub Actions
vechain/x-app-template
Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.
Get Env Var from Infisical
Devin-AXIS/iPolloWork
Loads a missing environment variable or API key from the team's Infisical workspace into the current shell, or runs a command with all project secrets injected.
Robotics Security
arpitg1304/robotics-agent-skills
Security hardening and best practices for robotic systems, covering SROS2 DDS security, network segmentation, secrets management, secure boot, and the physical-cyber safety intersection.
Deploying Cloud Deception With Decoy Resources
mukul975/Anthropic-Cybersecurity-Skills
Deploy cloud-native deception across AWS, Azure, and GCP using decoy (honey) resources whose only purpose is to generate a high-fidelity alert the instant an attacker touches them: canary IAM access…
Detecting Compromised Cloud Credentials
mukul975/Anthropic-Cybersecurity-Skills
Detect compromised cloud credentials across AWS, Azure, and GCP by analyzing anomalous API activity, impossible-travel patterns, and credential-stuffing indicators using GuardDuty, Microsoft…
More from YaoApp/yao
All 14 skills in this repoYao Agent Management Tools
YaoApp/yao
Lists, downloads, references and deploys agents on a Yao host through five bash-invoked tools, keeping edits to the smith namespace while allowing read-only study of any agent.
Yao Audio Transcription
YaoApp/yao
Transcribes audio files such as mp3, m4a, wav and webm to text with the tai audio_transcribe tool, and lists the available speech-to-text providers.
Yao Daemon Manager
YaoApp/yao
Starts, lists, checks, restarts and stops long-running background services through Yao daemon tools, reporting the verified port and URL of each.
Yao Image Tools
YaoApp/yao
Lets an agent read and describe images through a vision model and generate or edit images from text prompts, using the tai command-line tool.
Yao Background Job Manager
YaoApp/yao
Starts, lists, monitors, waits on and stops long-running background commands through a dedicated set of job-management tools.
Yao Workspace Files
YaoApp/yao
Lists workspaces and reads or writes their files on a remote node through five tai tool commands, for cross-node file work the local filesystem cannot do.
Related
Categories
Questions about Yao Secret Access
What does Yao Secret Access do?
Lets the agent list and read the secrets a user has configured, such as API keys and tokens, through two tai tools instead of hardcoding credentials into code or commands. This skill documents two tools called through bash with the tai command. secret_list returns the names and descriptions of the secrets configured for the current assistant but never their values.
When should I use Yao Secret Access?
Yao Secret Access fits situations like: A script needs an API key or token the user has already configured; checking which secrets are available before calling a service; authenticating git or an API call without writing credentials into files.
How do I install Yao Secret Access in Claude Code?
Run `npx skills add YaoApp/yao --skill yao-secret -a claude-code`. Or copy the skill folder (tools/skills/yao-secret in YaoApp/yao) into .claude/skills/yao-secret in your project. Claude Code loads it when a task matches its description.
How do I install Yao Secret Access in Codex?
Run `npx skills add YaoApp/yao --skill yao-secret -a codex`. Or copy the skill folder (tools/skills/yao-secret in YaoApp/yao) into .agents/skills/yao-secret in your project. Codex loads it when a task matches its description.
Can I use Yao Secret Access in Cursor, Gemini CLI or GitHub Copilot?
Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add YaoApp/yao --skill yao-secret -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/yao-secret, .gemini/skills/yao-secret, .github/skills/yao-secret and .opencode/skills/yao-secret in your project.
What does Yao Secret Access need to run?
Going by SKILL.md and its folder, Yao Secret Access needs credentials named GITHUB_TOKEN and AWS_SECRET_KEY. Our summary lists: The tai command-line tool; Secrets configured in the assistant's settings.
Does Yao Secret Access access the network?
SKILL.md contains no URLs. Any network use would come from the scripts or tools the agent runs. This is read from the text; nothing was executed.
Is Yao Secret Access safe to install?
Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.
What licence does Yao Secret Access use?
Yao Secret Access has a licence file (the repository's licence) that doesn't match a standard licence. Read it on GitHub before reusing the skill.
How many tokens does Yao Secret Access use?
About 415 tokens (SKILL.md is roughly 1.7k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.
What are the alternatives to Yao Secret Access?
Skills that share tags, products or a category with Yao Secret Access: Iron Proxy Gateway for NanoClaw (nanocoai/nanoclaw, 31k stars), Secure GitHub Actions (vechain/x-app-template, 450 stars), Get Env Var from Infisical (Devin-AXIS/iPolloWork, 6.8k stars) and Robotics Security (arpitg1304/robotics-agent-skills, 369 stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.
Who maintains Yao Secret Access?
YaoApp (a GitHub organization) maintains it in YaoApp/yao, which has 8,111 GitHub stars. The repository holds 14 skills in this directory. The repository was last updated on October 8, 2026.
Source: YaoApp/yao on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.