credentials
smol-machines/smolvmSkill
Gives a workload in a smolvm machine an API key or token it can use but never read, by binding the credential to named HTTPS hosts so the guest holds only a placeholder and the host substitutes the value on the way out, then proves on the host that the value never entered the machine. Use when an agent or untrusted code inside a machine has to call an API with your key; when deciding between a credential binding and --secret-env; when a request from a credentialed machine comes back 403 or 502 from smolvm itself; or when you need evidence that a key stayed out of a machine. Do not use it for a
Why this score
This repo hosts 10 skills, so its 6,769 stars are split between them (about 677 each) for scoring.
Popularity score: 73/100 from public GitHub signals only. It shows how widely used and maintained this is, not how well it works. Not included yet: the fake-star check. The security scan is shown separately and doesn't change the score. How we rank
Security
Scanned Oct 20, 2026 at commit c925bfd05cf6, with Cisco's open-source skill-scanner.
What its code does:
- Runs shell commands Common for dev tools. Read the commands it runs.scripts/verify-containment.sh:60
A scan lists patterns in the code. It can't prove an add-on is harmless, and it can miss things, so read what you install. How we scan
Alternatives
Other makers' add-ons that do the same job, next to this one.
| Name | Score | Stars | Context | Updated |
|---|---|---|---|---|
| This onecredentials smol-machines/smolvm · Skill | 73 | ★ 6.8k | ≈153 always | 16d ago |
| api-credentials oaustegard/claude-skills · Skill Both about credential and key | 60 | ★ 154 | ≈49 always | 20d ago |
| restore-credentials android/skills · Skill Both about credential | 79 | ★ 9.0k | ≈24 always | 16d ago |
| credential-tester 0xSteph/pentest-ai-agents · Subagent Both about credential | 64 | ★ 2.4k | ≈24 in chat | 29d ago |
| n8n-credentials-and-security-official n8n-io/skills · Skill Both about credential and secret | 66 | ★ 542 | ≈84 always | 18d ago |
| abusing-dpapi-for-credential-access mukul975/Anthropic-Cybersecurity-Skills · Skill Both about credential and secret | 81 | ★ 35k | ≈111 always | 2mo ago |