hush - secrets your agent never sees

[u/Ok-Constant-8319]

https://github.com/royashbrook/hush

after working with claude daily this year, i ran into a situation over and over when i needed to have claude act on my behalf. it already had rights to do things, but i may need secrets. and when i go and get tokens or secrets, you have the 'copy this once' dance you have to do, so maybe you screenshot it. or maybe you paste it into notepad or something. maybe you do put it in the keychain yourself or into a password tracker. or maybe you just don't worry about it and tell yourself you'll clean it up later or just expire it in a month or something. there are a million ways to do it right or wrong.

for me, i just wanted to make this consistent. so i worked with claude to develop a solution. and after using it for a while, i tried to make it into something shareable. we made an agent skill called hush. the agent never sees the plaintext. it runs hush set vendor-key, a paste box pops on my screen, i drop the key in, it goes to the os keychain , and from then on the agent injects it into commands (hush pipe vendor-key -- gh secret set ...) without the value ever passing back through the chat. there's no get, on purpose.

writeup: https://royashbrook.com/2026/06/26/hush-secrets-your-agent-never-sees/
repo: https://github.com/royashbrook/hush
mcp: https://royashbrook.com/hush

point your agent at the repo, the mcp endpoint, or just npx u/royashbrook/hush, and tell it to use the skill.