Your secrets. Your key. Your machine.
A KeePass vault sealed to your sovereign identity — opened by gpg-agent, never by a password on disk.
The KeePass master is PGP-sealed to your sovereign key and unlocked into gpg-agent. Reached through one stable shim, so the code can move without breaking a single caller.
skvault unlock && skvault get github
One stable verb (~/.skenv/bin/skvault) — unlock once, then fetch any secret.
Read the source ↗
skvault keeps your credentials in a KeePass database. The database's master passphrase is never typed and never sits on disk in the clear — it's PGP-sealed to your sovereign identity and lives, while unlocked, only inside gpg-agent. Lock it and it's gone again.
An open-format KeePass DB you own. Add credentials, fetch them by query, list and filter — all from the CLI, all on your machine.
vault_creds — store / get / list credentialscreds-init migrates the DB to skvault's path--showunlock / lock / status drive a gpg-agent seal. The master is PGP-sealed to your sovereign key via capauth.seal; unlock unseals it into the agent, lock evicts it.
unlock [--word W] — unseal into gpg-agentlock — evict the master from the agentstatus — is the vault open right now?Lose the key and you're not locked out forever. Split the passphrase into k-of-n Shamir shares, each PGP-sealed to a holder. No single holder can recover alone — the HashiCorp-Vault unseal model, made sovereign.
vault-share-init --holders a,b,cvault-recover --providers a,bOne crypto home, one secrets home, many consumers. capauth owns identity and the seal/unseal primitive. skvault is the only thing that holds secrets. Apps never touch the master — they go through the shim.
skos.secrets · skguide · .claude hooks
skvault sits alongside the other single-purpose sk* services.
skingest used to be the vault's home — now both seal through capauth and do exactly one job.
skvault is the result of a deliberate refactor (EPIC 11eeac9e).
Four choices define it.
The vault used to live inside skingest. Secrets management and document ingestion are different jobs, so the vault became its own package. skingest is now pure ingestion; both seal the same way, neither owns the other.
Crypto has one home: capauth — identity, sign/verify, and the
seal/unseal primitive. skvault doesn't reimplement any of it; it
depends on capauth.seal to PGP-seal the master and
unseal it into gpg-agent. skingest seals through the same primitive.
Every caller — agents, .claude hooks, skos.secrets, skguide —
invokes the skvault shim at ~/.skenv/bin/skvault,
never the package. When the backend moves, you edit one line in the shim
and nothing downstream breaks. The seam outlives the implementation.
The KeePass master passphrase is never stored in plaintext and never
kept by skvault itself. It's sealed to your sovereign PGP key; while unlocked it lives
only in gpg-agent; lock evicts it. Compromise the vault file
and you still have nothing without the key.
skvault unlock | lock | status | get <q> | list [filter] | creds-* | vault-*
Consumers like skos.secrets, skguide, and your .claude hooks call the exact same shim — never the package, never the master.
Most secret stores keep a key that unlocks everything — steal the store, steal the kingdom. skvault doesn't. The master is sealed to your sovereign PGP identity by capauth, held only by gpg-agent while open, and evicted on lock. The vault file alone is worthless. Crypto lives in capauth, secrets live in skvault, callers go through one shim — and your master goes nowhere.
skvault is the secrets layer of the SKWorld sovereign AI ecosystem. It seals through capauth and is consumed by skos, skguide, and the rest of the family.
KeePass secrets, a PGP-sealed master, one stable shim. The vault holds everything — except the one key that would matter.
skvault unlock && skvault get github
"staycuriousANDkeepsmilin" 🐧