blindfold
A security wrapper for handling API keys and credentials without exposing them in chat or files.
Install
mkdir -p .claude/skills/blindfold && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/18124" && unzip -o skill.zip -d .claude/skills/blindfold && rm skill.zipInstalls to .claude/skills/blindfold
Activation
This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.
Use Blindfold (Terminal 3 TDX enclave wrapper) to seal and use API keys safely. Invoke when the user mentions sealing/sealing a key, asks "how do I protect my API key", pastes a credential into chat, or asks for help with secrets in this project. Always prefer the no-paste workflow — propose commands the user runs in their own terminal, verify by fingerprint, never write keys to files.Key capabilities
- →Propose commands for users to seal API keys in their terminal
- →Verify sealed keys by fingerprint, not by value
- →Generate code that fetches provider keys from Terminal 3 just-in-time
- →Propose .env cleanup after successful key sealing
- →Troubleshoot Blindfold issues using diagnostic commands
How it works
The skill guides the user to seal API keys using Blindfold, a Terminal 3 TDX-enclave wrapper, by proposing terminal commands and verifying the sealing process without exposing the key value. It also provides code templates for using sealed keys.
Inputs & outputs
When to use blindfold
- →Seal API keys for environment use
- →Protect sensitive credentials
- →Set up secure vaulting
- →Handle project-specific secrets safely
About blindfold
Ensures developers can use API keys safely by proposing terminal commands that seal secrets within an enclave. It prevents the insecure practice of pasting credentials into AI chats.
Use Blindfold (Terminal 3 TDX enclave wrapper) to seal and use API keys safely. Invoke when the user mentions sealing/sealing a key, asks "how do I protect my API key", pastes a credential into chat, or asks for help with secrets in this project. Always prefer the no-paste workflow — propose command
When not to use it
- →Writing a real plaintext key value to any file
- →Logging a value whose origin is process.env.*_API_KEY
- →Generating code that references process.env.<provider>_API_KEY for outbound calls
Limitations
- →Cannot write plaintext key values to files or logs
- →Cannot suggest pasting keys into chat as a default
- →Cannot generate code referencing process.env.<provider>_API_KEY for outbound calls
How it compares
This skill enforces a no-paste workflow for API keys and integrates with a secure enclave for key management, which is more secure than directly pasting credentials into chat or storing them in .env files.
Compared to similar skills
blindfold side by side with the closest alternatives in the catalog.
| Skill | Installs | Updated | Safety | Difficulty |
|---|---|---|---|---|
| blindfold (this skill) | 0 | 2mo | Caution | Intermediate |
| 1password | 27 | 3mo | Review | Intermediate |
| security-compliance | 19 | 8mo | Review | Advanced |
| information-security-manager-iso27001 | 11 | 8mo | Review | Advanced |
Try saying
Example prompts that trigger this skill in your AI assistant.
You might also like
1password
openclaw
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
security-compliance
davila7
Guides security professionals in implementing defense-in-depth security architectures, achieving compliance with industry frameworks (SOC2, ISO27001, GDPR, HIPAA), conducting threat modeling and risk assessments, managing security operations and incident response, and embedding security throughout the SDLC.
information-security-manager-iso27001
davila7
Senior Information Security Manager specializing in ISO 27001 and ISO 27002 implementation for HealthTech and MedTech companies. Provides ISMS implementation, cybersecurity risk assessment, security controls management, and compliance oversight. Use for ISMS design, security risk assessments, control implementation, and ISO 27001 certification activities.
cursor-sso-integration
jeremylongshore
Configure SSO and enterprise authentication in Cursor. Triggers on "cursor sso", "cursor saml", "cursor oauth", "enterprise cursor auth", "cursor okta". Use when working with cursor sso integration functionality. Trigger with phrases like "cursor sso integration", "cursor integration", "cursor".
springboot-security
affaan-m
Spring Security best practices for authn/authz, validation, CSRF, secrets, headers, rate limiting, and dependency security in Java Spring Boot services.
django-security
affaan-m
Django security best practices, authentication, authorization, CSRF protection, SQL injection prevention, XSS prevention, and secure deployment configurations.