Vault Secrets Operator
Lets an agent check, read, write, list and delete secrets in a local HashiCorp Vault dev instance.
- Repository
- mvschwarz/openrig
- Stars
- 8,553
- Licence
- Apache-2.0
- Files
- 1 file
What it does
When installed, the agent knows how to talk to a local HashiCorp Vault server that an OpenRig rig manages. It can check whether Vault is healthy, store a key-value secret at a path, read a secret back, list the secrets under a prefix, delete one, and summarize what secrets exist. It works by sending HTTP requests to Vault's API using curl, rather than relying on a separate tool.
Great for
- Developers running a local OpenRig rig who want an agent to manage development secrets
- Teams testing agent workflows that need to store or fetch API keys in a throwaway Vault
- People who want a quick summary of which secret paths exist in the local dev Vault
Skip it if
- Production secrets or any real credentials: the skill uses a hardcoded dev token and Vault dev mode keeps data only in memory, so it is unsafe and unreliable for real use
- Environments where Vault is not on 127.0.0.1:8200: the connection details are fixed and will fail elsewhere
Try asking
- “Check whether the local Vault is healthy and unsealed”
- “Store the value sk-test-123 under the path myapp/api-key”
- “List all secret paths under the secret store and explain what each one holds”
- “Delete the secret at myapp/old-token”
Install in 3 steps
- 1
Download the skill
The ZIP contains the 1 original files, the Apache-2.0 licence and an attribution note.
vault-user.zip - 2
Add it to your agent
Claude Code (all projects)
mkdir -p ~/.claude/skills && unzip vault-user.zip -d ~/.claude/skills/Claude Code / Agent SDK (this project only)
mkdir -p .claude/skills && unzip vault-user.zip -d .claude/skills/Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.
- 3
Ask for the task
No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.
Get better results
- Only use this against the local dev Vault; do not point it at production or paste real secrets you cannot afterwards lose, since data resets on restart.
- Ask for a health check first so the agent confirms Vault is unsealed before attempting reads or writes.
- When listing or explaining secrets, name a prefix such as myapp/ to keep output manageable.
What's inside
- SKILL.md
Redistributed unmodified from mvschwarz/openrig under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.