credentials

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Safe Credentials Protocol

安全凭证协议

Many skills require API keys or other credentials to function or to access higher rate limits. This skill defines the standard safe credentials protocol for verifying and prompting for these credentials without leaking sensitive keys into the agent context or the conversation history.

许多Skill需要API密钥或其他凭证才能正常运行，或是获取更高的调用速率限制。本Skill定义了一套标准的安全凭证协议，用于验证和提示用户补充这些凭证，同时避免将敏感密钥泄露至Agent上下文或对话历史中。

Safe Verification (No Leaks)

安全验证（无泄露）

As soon as a skill that requires a credential or API key looks relevant to the user's request, you MUST immediately verify if the credential is present in the

.env

file (typically located in your home directory

~/.env

or the project root) — before doing any other work for that skill.

CRITICAL: You must verify the presence of the credential without printing its value to the terminal or reading it into your context.

当某个需要凭证或API密钥的Skill看起来与用户请求相关时，你必须立即验证该凭证是否存在于

.env

文件中（通常位于主目录

~/.env

或项目根目录）——在执行该Skill的任何其他操作之前。

关键注意事项：你必须在不将凭证值打印到终端或读取到上下文的前提下，验证凭证是否存在。

How to verify:

验证方法：

Use

grep

in quiet and suppress-errors mode (

-sq

) to check if the variable is defined in

~/.env

. The

-s

flag ensures the command works cleanly even if

~/.env

does not exist yet.

bash

grep -sq "^CREDENTIAL_NAME=" ~/.env

Replace

CREDENTIAL_NAME

with the actual credential name required by the calling skill (e.g.,

ALPHAGENOME_API_KEY

USER_EMAIL

If the command succeeds (exit code 0), the credential is present. You can proceed.
If the command fails (any non-zero exit code — whether the credential is missing or the
```
.env
```
file does not exist yet), the credential is missing. You MUST IMMEDIATELY stop and prompt the user to add it using the instructions in Prompting the User to Add Credentials before attempting to run any scripts or tools. Do not conclude the turn by simply stating that the key is missing.

[!CRITICAL] If verification fails (any non-zero exit code), you MUST NOT attempt to execute any tools or scripts from the calling skill, nor should you conclude the turn by simply reporting the missing key. You MUST IMMEDIATELY generate the appropriate terminal command from the templates below and prompt the user to run it. The template command will create the
.env
file if it does not already exist.

NEVER run

cat ~/.env

grep "VAR" ~/.env

(without

-q

echo $VAR

, or

printenv

to check for credentials.

使用

grep

命令的静默模式和抑制错误模式（

-sq

）来检查

~/.env

中是否定义了该变量。

-s

参数确保即使

~/.env

文件尚未存在，命令也能正常执行。

bash

grep -sq "^CREDENTIAL_NAME=" ~/.env

将

CREDENTIAL_NAME

替换为调用Skill所需的实际凭证名称（例如

ALPHAGENOME_API_KEY

或

USER_EMAIL

）。

如果命令执行成功（退出码为0），说明凭证已存在，你可以继续后续操作。
如果命令执行失败（任何非零退出码——无论是凭证缺失还是
```
.env
```
文件尚未存在），说明凭证缺失。你必须立即停止当前操作，并按照提示用户添加凭证中的说明，提示用户添加凭证，之后再尝试运行任何脚本或工具。不能仅告知用户密钥缺失就结束当前交互。

[!CRITICAL] 如果验证失败（任何非零退出码），你不得尝试执行调用Skill的任何工具或脚本，也不能仅报告密钥缺失就结束当前交互。你必须立即根据下方模板生成对应的终端命令，提示用户运行该命令。模板命令会在
.env
文件不存在时自动创建它。

绝对不要使用

cat ~/.env

、

grep "VAR" ~/.env

（不带

-q

参数）、

echo $VAR

或

printenv

命令来检查凭证。

Prompting the User to Add Credentials

提示用户添加凭证

If a credential is missing, do NOT ask the user to paste it into the chat. This would leak the value into the agent's context and the conversation history.

Instead, you MUST generate a specific command for the user to run in their terminal by replacing the placeholders in one of the templates below.

CRITICAL: Before presenting the command to the user, you MUST replace:

```
CREDENTIAL_NAME
```
with the actual variable name needed (e.g.,
```
ALPHAGENOME_API_KEY
```
,
```
USER_EMAIL
```
).
```
ENV_FILE
```
with the resolved literal path to the
```
.env
```
file (usually
```
~/.env
```
).

如果凭证缺失，不要让用户将凭证粘贴到聊天框中。这会将凭证值泄露至Agent的上下文和对话历史中。

相反，你必须通过替换下方模板中的占位符，生成一个供用户在终端中运行的特定命令。

关键注意事项：在向用户展示命令之前，你必须替换：

```
CREDENTIAL_NAME
```
为所需的实际变量名称（例如
```
ALPHAGENOME_API_KEY
```
、
```
USER_EMAIL
```
）。
```
ENV_FILE
```
为
```
.env
```
文件的实际路径（通常为
```
~/.env
```
）。

Template

模板

All credentials are treated as sensitive. The

read -s

flag hides the user's typing. You MUST inform the user that their typing will be hidden.

CRITICAL: When requesting a credential, you MUST also provide the user with the appropriate registration link or instructions provided by the calling skill so they know how to obtain the value if they do not have one.

bash

printf "Enter CREDENTIAL_NAME (typing hidden): " && read -s val && echo && echo "CREDENTIAL_NAME=$val" >> "ENV_FILE" && echo "Saved."

所有凭证均视为敏感信息。

read -s

参数会隐藏用户的输入内容。你必须告知用户他们的输入会被隐藏。

关键注意事项：在请求凭证时，你必须同时提供调用Skill给出的相应注册链接或说明，以便用户在没有凭证时知道如何获取。

bash

printf "Enter CREDENTIAL_NAME (typing hidden): " && read -s val && echo && echo "CREDENTIAL_NAME=$val" >> "ENV_FILE" && echo "Saved."

Running scripts requiring credentials

运行需要凭证的脚本

All helper scripts inside the calling skills load these credentials automatically from the

.env

file using

dotenv

You do NOT need to manually read the keys, export them to the shell environment, or pass them as CLI arguments, when calling the helper scripts that require them. As long as you have verified the key is present in

.env

using the safe protocol above, simply run the script directly — the script will load the credential automatically.

调用Skill中的所有辅助脚本都会通过

dotenv

自动从

.env

文件加载这些凭证。

当调用需要凭证的辅助脚本时，你无需手动读取密钥、将其导出到Shell环境或作为CLI参数传递。只要你已通过上述安全协议验证密钥存在于

.env

文件中，直接运行脚本即可——脚本会自动加载凭证。