QWQ Local Password Vault
This skill provides a small, local-only credential vault for Windows. The vault root is the installed skill directory: secrets\ sits beside scripts\.
Safety Rules
- Never write plaintext passwords, tokens, Secret Keys, or private keys into Markdown, source code, Git-tracked files, screenshots, or chat output.
- Never include
secrets\*.credential.clixmlin an upload or package. - Prefer copying a secret to the clipboard. Reveal a secret only when the user explicitly requests it.
- CLIXML encryption is tied to the current Windows user and machine. This is not a team password manager.
Files
<skill-root>\
├─ SKILL.md
├─ agents\openai.yaml
├─ scripts\
│ ├─ Save-Secret.ps1
│ ├─ Get-Secret.ps1
│ ├─ List-Secrets.ps1
│ ├─ Remove-Secret.ps1
│ └─ Rotate-Secret.ps1
├─ secrets\
│ └─ *.credential.clixml
└─ templates\secret-entry.template.md
The scripts use Windows DPAPI through PowerShell Export-Clixml secure strings. Run them from the skill root or use their absolute paths.
Save
cd <skill-root>
.\scripts\Save-Secret.ps1 -Name "entry-name" -Url "https://example" -Username "username-or-access-key" -Notes "non-secret notes"
The script prompts for the secret with Read-Host -AsSecureString. Existing entries require -Force and an overwrite confirmation. The file is written to a temporary path and atomically replaced after the write succeeds.
List Metadata
.\scripts\List-Secrets.ps1
This lists names, URLs, usernames, notes, and timestamps without decrypting or printing secret values.
Copy or Reveal
Copy without printing:
.\scripts\Get-Secret.ps1 -Name "entry-name" -CopySecret
The clipboard is automatically cleared after 30 seconds if its contents have not changed. Use -ClearClipboardAfterSeconds to choose another delay. -CopySecret and -RevealSecret are mutually exclusive.
Reveal only after an explicit request:
.\scripts\Get-Secret.ps1 -Name "entry-name" -RevealSecret
Rotate or Delete
Rotate an existing secret while preserving metadata by default:
.\scripts\Rotate-Secret.ps1 -Name "entry-name"
Delete an entry with confirmation:
.\scripts\Remove-Secret.ps1 -Name "entry-name"
Update any separate non-secret inventory manually after renaming, rotating metadata, or deleting an entry. Do not put the secret value in that inventory.
Recovery Limits
Back up the encrypted files only for the same Windows user and machine. For migration or team sharing, use KeePassXC, Bitwarden, 1Password, or an organization-managed vault instead.
