Guide · Agent skill
How to use the Vault Secrets Operator agent skill (vault-user)
Updated · written with AI from the project's own documentation and checked against our catalogue data
The vault-user skill is a set of instructions that teaches an AI agent how to work with a local HashiCorp Vault server managed by an OpenRig rig. Once it is installed, you can ask the agent to check Vault's health, store, read, list or delete development secrets, or summarize which secret paths exist. This guide explains what the skill does, how to install it, how to trigger it, and what limits to respect before you use it.
Vault Secrets Operatormvschwarz/openrig · Apache-2.0 Download the skill Quick start
- 1Confirm prerequisites. Make sure curl and jq are installed and that a local Vault dev server is running at http://127.0.0.1:8200, typically started by an OpenRig rig.
- 2Download the skill ZIP. Download the vault-user ZIP from this page.
- 3Install the skill. Unzip it into ~/.claude/skills/ for personal use or into a project's .claude/skills/ folder, or upload the ZIP under Settings → Capabilities → Skills in the Claude apps.
- 4Run a health check. Ask the agent whether the rig's Vault is healthy and confirm it reports initialized true and sealed false.
- 5Make a test write and read. Store a throwaway key at a dev path, then read it back to confirm the round trip works.
- 6List and clean up. List the secrets under your prefix, then delete the test secret you created.
What is an agent skill, and what does vault-user do?
An agent skill is a folder containing a SKILL.md file with instructions that an AI agent reads when a request matches the skill's description. The vault-user skill's description says it applies when you check the health of your rig's HashiCorp Vault or write, read, list, delete or explain its secrets.
With the skill installed, the agent knows how to talk to a local Vault server at http://127.0.0.1:8200. It sends HTTP requests to Vault's API using curl rather than relying on a separate tool.
- Check whether Vault is healthy
- Write a key-value secret at a path
- Read a secret back
- List secrets under a prefix
- Delete a secret
- Summarize which secret paths exist
What you need before installing vault-user
The skill requires curl and jq on the machine where the agent runs. It also needs a running local HashiCorp Vault dev server at http://127.0.0.1:8200, which is typically started by an OpenRig rig. The OpenRig rig env command is optional, and the skill uses it for health checks if available.
- curl
- jq
- A running Vault dev server at http://127.0.0.1:8200
- Optional: the OpenRig rig env command
How to install the vault-user skill
Download the ZIP for this skill from this page. Then choose one of two install routes.
For a personal install that applies to all your projects, unzip the download into ~/.claude/skills/. For a single project, unzip it into that project's .claude/skills/ folder.
In the Claude apps, you can instead upload the ZIP under Settings → Capabilities → Skills.
- Personal: unzip into ~/.claude/skills/
- Project only: unzip into .claude/skills/ inside the project
- Claude apps: Settings → Capabilities → Skills, then upload the ZIP
How to trigger the skill with natural requests
You do not need a special command. Describe what you want in plain language that mentions Vault, secrets, or the health of the rig's Vault. The skill's description matches requests about checking health or writing, reading, listing, deleting or explaining secrets.
Be specific about the secret path when you can, such as a name like dev/app or a prefix to list. The agent builds the request from the path you give.
- "Check whether the rig's Vault is healthy."
- "Store the value abc123 as key api_key at path dev/payments."
- "Read the secret at dev/payments and show me the value."
- "List the secrets under dev/."
- "Delete the secret at dev/old-test."
- "Explain what secrets exist in the local Vault and what each contains."
Examples of what the agent runs
The skill documents these request patterns. The agent fills in the path. Replace the angle-bracket placeholder with a real path when you test it yourself.
The health check fetches the sys/health endpoint. A healthy response has "initialized": true and "sealed": false.
curl -s http://127.0.0.1:8200/v1/sys/health | jq .Safety notes: scripts and network access
This skill runs scripts and uses the network. Every request goes to 127.0.0.1:8200 on your own machine, and the skill sends a hardcoded dev token, openrig-dev-token, in the X-Vault-Token header.
Vault dev mode keeps all data in memory, so anything stored is lost when the server restarts. Do not store production secrets or any real credentials with this skill. The connection details are fixed, so the skill will fail on any host where Vault is not on 127.0.0.1:8200.
- Use it only with throwaway development data
- Do not store production or real credentials
- Expect data loss on Vault restart
- Fails where Vault is not at 127.0.0.1:8200
Tips for getting reliable results
Run the health check first. The skill's notes say to use the rig env status command to verify Vault health through OpenRig before probing Vault directly.
Ask for summaries when you want an overview. The skill says that when asked to explain the secret structure, the agent lists all paths and summarizes each one, using the list endpoint recursively if needed.
- Start with a health check to confirm Vault is up and unsealed
- Use rig env status to verify health through OpenRig first
- Remember the KV engine is mounted at secret/ by default in dev mode
What people use it for
- Storing a throwaway API key at a dev path so a test agent workflow can fetch it
- Listing the secret paths under a prefix to see what a local dev setup contains
- Asking for a plain-language summary of every secret path in the local dev Vault
- Deleting leftover test secrets after an agent workflow finishes
Frequently asked questions
How do I install the vault-user agent skill?
Download the ZIP from this page and unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project. In the Claude apps, you can upload the ZIP under Settings → Capabilities → Skills.
What does the vault-user skill require?
It requires curl and jq, plus a running local HashiCorp Vault dev server at http://127.0.0.1:8200, which is typically started by an OpenRig rig. The OpenRig rig env command is optional and used for health checks.
Is the vault-user skill free to use?
The source identifies the licence as Apache-2.0 for the repository. Check the repository's licence file for the full terms before reuse.
Can I use vault-user with production secrets?
No. The skill uses a hardcoded dev token, and Vault dev mode keeps data only in memory and loses it on restart. It is meant for throwaway development data only.
Why does the skill fail with my Vault server?
The connection address and token are fixed in the skill as http://127.0.0.1:8200 and openrig-dev-token. If your Vault runs anywhere else, requests will fail.
How does vault-user compare to using the Vault CLI directly?
The skill works by sending HTTP requests to Vault's API with curl instead of relying on a separate tool. It is aimed at quick, agent-driven dev secret tasks, not production secret management.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use vault-user if you run a local OpenRig rig and want an agent to store, read, list and delete throwaway development secrets in a local Vault dev server. Pick something else for production secrets, real credentials, or any Vault that is not reachable at 127.0.0.1:8200.
Download the skill