keepassxc-secrets
Fetches and manages credentials securely from a KeePassXC vault using the kpxc-agent CLI for seamless integration in tasks.
Install this skill
or
92/100
Security score
The keepassxc-secrets skill was audited on Jul 31, 2026 and we found 8 security issues across 1 threat category. Review the findings below before installing.
Categories Tested
Security Issues
low line 51
Command substitution pattern
SourceSKILL.md
| 49 | |
| 50 | ```bash |
| 51 | pw=$(kpxc-agent get-logins URL --field password) |
| 52 | ``` |
| 53 |
low line 60
Command substitution pattern
SourceSKILL.md
| 58 | ```bash |
| 59 | kpxc-agent get-logins https://host.example --json # safe to read/show |
| 60 | pw=$(kpxc-agent get-logins https://host.example --field password --entry-uuid <uuid>) |
| 61 | ``` |
| 62 |
low line 101
Command substitution pattern
SourceSKILL.md
| 99 | |
| 100 | ```bash |
| 101 | eval "$(kpxc-agent --trigger-unlock associate)" |
| 102 | ``` |
| 103 |
low line 141
Command substitution pattern
SourceSKILL.md
| 139 | **Fetch a single password (most common):** |
| 140 | ```bash |
| 141 | pw=$(kpxc-agent get-logins https://host.example --field password) |
| 142 | ``` |
| 143 |
low line 149
Command substitution pattern
SourceSKILL.md
| 147 | **Fetch the whole entry into shell vars:** |
| 148 | ```bash |
| 149 | eval "$(kpxc-agent get-logins https://host.example)" |
| 150 | # now $KPXC_USERNAME and $KPXC_PASSWORD are set (in memory only) |
| 151 | ``` |
low line 157
Command substitution pattern
SourceSKILL.md
| 155 | kpxc-agent get-logins https://host.example --json |
| 156 | # [{"uuid":"a1…","name":"Box prod","login":"admin"},{"uuid":"b2…","name":"Box staging",…}] |
| 157 | pw=$(kpxc-agent get-logins https://host.example --field password --entry-uuid a1…) |
| 158 | ``` |
| 159 | `--index N` (0-based) works too. Without a selector, `--field` reads the first match and |
low line 168
Command substitution pattern
SourceSKILL.md
| 166 | so `eval` it into a variable rather than capturing stdout directly: |
| 167 | ```bash |
| 168 | eval "$(kpxc-agent generate-password)" # sets $KPXC_PASSWORD, in memory only |
| 169 | ``` |
| 170 | > If a command seems to hang, KeePassXC is probably showing a confirmation dialog the |
low line 182
Command substitution pattern
SourceSKILL.md
| 180 | uuid`). Like generate-password it prints `KPXC_TOTP=…`, so `eval` it too: |
| 181 | ```bash |
| 182 | eval "$(kpxc-agent get-totp "$uuid")" # sets $KPXC_TOTP |
| 183 | ``` |
| 184 |
Scanned on Jul 31, 2026
View Security DashboardRating
4.01
Rate this skill
Categorydevelopment
UpdatedAugust 9, 2026
clinevscodefrontenddesignplaywrightdocxgitapidatabasetestingbackenddevops-srebackend-developersecurity-engineerdevelopment
max-win-at/keepassxc-cli-integration