Manage and track local API keys, secrets, and tokens with rotation status, risk levels, auditing, and policy enforcement without storing actual secret values.
Security Analysis
medium confidenceThe skill's code, instructions, and requested resources are consistent with a local key/rotation tracker that scans .env files and environment variables and stores metadata (not raw secret values), but there are minor documentation/code inconsistencies and at least one coding bug you should review before installing.
The name/description match the implementation: the package scans .env files and environment variables, detects service patterns, records metadata (name, prefix, SHA256 hashes if provided), tracks rotation history and audit logs, and stores everything under ~/.nex-keyring in SQLite. There are no unexpected cloud credentials or unrelated external services requested.
SKILL.md and the code direct the tool to read .env files and environment variables (intentional and expected). The implementation generally avoids storing actual secret values (it stores presence, prefixes and hashes), but scanning environment variables and files is inherently sensitive — ensure you understand the privacy implications and that the agent or the person running setup is trusted.
There is no remote install step or external download; installation is via the included setup.sh which writes files under the user's home (~/.nex-keyring) and creates a wrapper in ~/.local/bin. No network fetching or third‑party installers are invoked. Note: the setup script initially writes a wrapper with a hardcoded path then rewrites it to use SKILL_DIR; this looks odd but the final wrapper is created from the local skill directory.
The skill declares no required environment variables or external credentials (consistent with purpose). README mentions optional env overrides (NEX_KEYRING_HOME, NEX_KEYRING_DB) not visible in the provided code — a small documentation/code mismatch. The code does inspect os.environ to detect keys (expected), but it does not appear to exfiltrate environment contents.
The skill does not request global/system privileges or 'always' inclusion. It stores files under the user's home and creates a user-level CLI wrapper (~/.local/bin). It does not modify other skills or system-wide configs beyond that user-level install.
Guidance
This package appears to do what it claims: locally scan .env files and environment variables, track key metadata and rotation history, and avoid storing actual secret values. Before installing or running setup.sh, consider: 1) Review the setup.sh wrapper path that is written — ensure it points to the skill files on your machine (it tries to locate SKILL_DIR but double-check). 2) The tool reads environment variables and .env files — only run it in contexts where you trust the host and operator, and avoid running on machines with untrusted processes. 3) There are small code/documentation inconsistencies (README mentions env overrides that aren't evident in the code) and at least one apparent coding bug (truncated/undefined variable in storage.list_secrets that may cause runtime errors). I recommend auditing the code locally (especially storage.list_secrets and any truncated sections), running setup.sh in a controlled environment or container, installing the cryptography package if you want Fernet encryption, and backing up any sensitive files before first run. If you want higher assurance, ask the author for a complete, non-truncated source and unit tests demonstrating behavior (or run it in an isolated VM/container).
Latest Release
v1.0.0
Initial release
More by @nexaiguy
Published by @nexaiguy on ClawHub
