docs: add pass-cli agent skill and track .claude/skills - #101
Merged
Conversation
Adds a committed agent skill at .claude/skills/pass-cli/SKILL.md so AI agents that clone this repo know how to drive pass-cli safely — defaulting to `exec` for handing secrets to child processes, using the safe-by-default `list -q`, and avoiding the get/command-substitution leak traps. The flag surface in the skill is verified against cmd/exec.go, cmd/list.go, and cmd/get.go. Un-ignores .claude/skills in .gitignore so skills ship with the repo and are reachable by every agent; settings.local.json and hookify files stay local. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_019sxsM218vNzDbuMZ2nhMzx
arimxyer
added a commit
that referenced
this pull request
Jun 26, 2026
…105) The branch ruleset requires Lint, Unit Tests, Build, and Integration Tests (x3) on every PR. The jobs in ci.yml already short-circuit to success via their "Skip if no code changes" steps (gated on the check-changes filter), so non-code PRs are meant to satisfy the required checks in seconds. But a workflow-level `pull_request: paths-ignore` (**.md, docs/**, .gitignore, ...) suppressed the entire workflow for docs/skill/gitignore-only PRs — so the required checks never reported and those PRs were blocked forever (e.g. #101, the agent-skill PR, which touches only .gitignore + SKILL.md). Remove the pull_request paths-ignore so the workflow always runs on PRs; check-changes + the per-job skip steps still make non-code PRs go green quickly. The push paths-ignore is left as-is (post-merge main CI is not a required gate). Claude-Session: https://claude.ai/code/session_019sxsM218vNzDbuMZ2nhMzx Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
arimxyer
added a commit
that referenced
this pull request
Jun 27, 2026
…#111) Two user-facing changes shipped without docs and are now covered ahead of the 0.18.0 release: - exec (#98): new command reference entry, and scripting-guide rewritten to lead with `pass-cli exec` as the recommended way to hand a credential to a child command (env injection, never touches files/clipboard/history). The old `$(pass-cli get ...)` substitution is kept as a documented fallback with an explicit shell-tracing/CI-log leak caveat. README gains exec examples. - list safe-by-default (#95, #97): documented that the table now hides the Username column by default, plus the new --show-usernames and -q/--quiet flags, across command-reference, scripting-guide, and README. Also: - CHANGELOG: populate the long-stale [Unreleased] (top entry was 0.17.2) with everything since — exec, list-safe, sync content-hash markers (#102), unlock-latency overlap (#103), startup-latency cleanup (#104), tracked mise.toml (#100), CI-on-all-PRs (#105), agent skill (#101) — and head it as [0.18.0]. - CLAUDE.md: refresh the Sync Architecture notes for the #102 marker-based change detection and the #103 overlapped pre-unlock pull. No code changed. Claude-Session: https://claude.ai/code/session_019sxsM218vNzDbuMZ2nhMzx Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a committed agent skill so AI agents that work in this repo know how to
drive
pass-clisafely, and tracks.claude/skillsso skills ship with therepo.
.claude/skills/pass-cli/SKILL.md— the skill. Its decision model: defaultto
pass-cli execfor handing a secret to a child process (value never touchesstdout/clipboard/history), use
pass-cli list -qfor safe discovery, and treatpass-cli get --quietas a last resort with an explicit leak-trap warning.Documents
execend-to-end:--set ENV=service[:field], the convenience form,-f/--field, the--separator, exit-code propagation, and thatexecisread-only (no usage write, no sync push).
.gitignore— un-ignores.claude/skills(the comment now notes it'sintentionally tracked).
settings.local.jsonandhookify.*.local.mdstaylocal-only.
Verification
The documented flag surface was checked against source, not recalled:
exec--set/-f/service:field/--→cmd/exec.golist -q/--show-usernames/ username-hidden default →cmd/list.goget --quiet/--no-clipboard→cmd/get.goNo code changes; this is docs + a
.gitignoreline.🤖 Generated with Claude Code