What problem does it solve? API keys pasted into chat, code, logs, or notes become permanently exposed in transcripts and shared environments. This Skill enforces a disciplined workflow that puts every credential into the one masked destination that keeps it out of the conversation record. ## Core Features & Use Cases - Destination selection: Routes each credential to the correct card — the plugin variable card for connector configuration or the Bot secret card for a Bot's own scripts. - Leak prevention and rotation handling: Interrupts attempted key pastes, treats any secret spoken in chat as burned, and triggers a ROTATE finding with owner and date metadata. - Safe verification: Confirms credentials work through read-only calls (whoami, list, get) instead of echoing or printing values, and requires wrapper scripts to live in bot-independent directories like /home/box/mcp-wrappers/. - Use Case: A connector needs an organization API key. The Skill names the ${VAR}, hands the human the exact click path to the plugin variable card, places the wrapper script outside any agent-scoped secrets tree, and verifies with a read-only call — the value never touches chat. ## Quick Start Ask the assistant to set up an API key for a connector using the secret card setup workflow, naming the variable and the plugin that consumes it.
