---
name: Ops Credentials
slug: ops-credentials
category: DevOps
description: Ops Credentials audits which integration secrets are configured or missing across env vars, preferences, Keychain, and Dashlane. Use it to check setup status, re-audit one service, or export a masked JSON report.
github: "https://github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/claude-ops/skills/ops-credentials"
language: Shell
stars: 186
forks: 21
install: "npx degit https://github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/claude-ops/skills/ops-credentials ~/.claude/skills/ops-credentials"
installs_to: ~/.claude/skills/ops-credentials
source_path: claude-ops/skills/ops-credentials/SKILL.md
collection_size: 25
category_size: 1013
collection_url: "https://dirskills.com/collections/Lifecycle-Innovations-Limited/claude-ops"
added: 2026-09-06T05:20:35.752Z
last_synced: 2026-09-06T05:20:35.752Z
canonical_url: "https://dirskills.com/skills/ops-credentials"
---

# Ops Credentials

Ops Credentials audits which integration secrets are configured or missing across env vars, preferences, Keychain, and Dashlane. Use it to check setup status, re-audit one service, or export a masked JSON report.

**Install:**

```bash
npx degit https://github.com/Lifecycle-Innovations-Limited/claude-ops/tree/main/claude-ops/skills/ops-credentials ~/.claude/skills/ops-credentials
```

## README

# OPS ► CREDENTIALS

Load `ops-rules` before acting. Public repo (no personal data). Outbound: one draft → one approval → one send. If `AskUserQuestion` / `Workflow` are missing, follow Rule 10 in `ops-rules` (Hermes: numbered options / two-turn Telegram card; `delegate_task`).

## CLI/API Reference

| Command                                | Output                                         |
| -------------------------------------- | ---------------------------------------------- |
| `bin/ops-credentials`                  | Human table — configured + missing per service |
| `bin/ops-credentials --json`           | JSON array, one entry per credential           |
| `bin/ops-credentials --service stripe` | Filter to one integration                      |

The bin script is the source of truth. It scans these sources in order and reports the FIRST hit per credential:

1. Shell env (`$STRIPE_SECRET_KEY`, etc.)
2. `$OPS_DATA_DIR/preferences.json` (`.revenue.stripe.secret_key`, etc., including `doppler:KEY` references that get resolved live)
3. macOS Keychain (`security find-generic-password -s <name> -w`)
4. Dashlane (`dcli password <keyword> --output json`)

Values shorter than 12 chars print as `•••`; longer values print as `first6•••last4`.

## Your task

When the user runs `/ops:credentials`:

1. **Run** `bin/ops-credentials` and present the output verbatim — it's already formatted for the user's terminal (compact mode for SSH/mobile, table layout otherwise).

2. **Offer follow-ups via AskUserQuestion (max 4 options per Rule 1):**

```
What would you like to do next?
  [Configure a missing service — pick one to set up now]
  [Re-audit a specific service]
  [Export to JSON]
  [Done]
```

3. **On "Configure missing"**: list missing services 4-at-a-time via `AskUserQuestion`. For each pick, call the `/ops:setup <service>` skill.

4. **On "Re-audit specific"**: ask for the service name and run `bin/ops-credentials --service <name>`.

5. **On "Export to JSON"**: run `bin/ops-credentials --json` and write the result to `/tmp/ops-credentials-audit-$(date +%s).json`. Print the path.

## Why this skill exists

Claude Code's plugin settings UI cannot introspect external credential stores. If a user has `STRIPE_SECRET_KEY` in macOS Keychain or `klaviyo_api_key` in Doppler, the settings panel shows those fields as empty (because the value isn't stored in Claude Code's user-config). The user can't tell at a glance which integrations they've already wired up.

`/ops:credentials` solves that — one command, one table, complete picture of which integrations are ready to use vs which still need `/ops:setup`.

## Homey Pro (Home Automation)

| Field        | Value                                                                                                       |
| ------------ | ----------------------------------------------------------------------------------------------------------- |
| Service name | Homey Pro                                                                                                   |
| Category     | Home Automation                                                                                             |
| Keys         | `HOMEY_LOCAL_URL`, `HOMEY_LOCAL_TOKEN`, `HOMEY_CLOUD_TOKEN`, `HOMEY_ID`                                     |
| Storage      | `$PREFS_PATH` → `.home_automation.homey_local_url`, `.homey_local_token`, `.homey_cloud_token`, `.homey_id` |
| Required     | `HOMEY_LOCAL_URL`, `HOMEY_LOCAL_TOKEN`                                                                      |
| Optional     | `HOMEY_CLOUD_TOKEN` (off-LAN fallback), `HOMEY_ID` (cloud API only)                                         |

**Rotation:** Revoke the current token at `https://my.homey.app/manager/tokens`, generate a new one, then rerun `/ops:setup --section home` to save the replacement.

---

## Privacy guarantees

- **Never prints raw values.** All output is masked.
- **Never copies values to disk.** Reads happen in-process; the JSON export contains only `{service, label, configured, masked, source}`, never the raw secret.
- **Read-only.** Does not write to keychain, Doppler, or preferences.

## Mobile / SSH (Rule 7)

When `$SSH_CONNECTION` / `$SSH_CLIENT` / `$SSH_TTY` is set or `$OPS_MOBILE=1`, the bin script auto-switches to compact one-line-per-cred format. Skill output should pass it through unchanged.