Reading Secrets from Proton Pass

The Proton Pass CLI (pass-cli) resolves secret references so credentials never need to be pasted into a conversation, a script, or shell history. The guiding principle: the plaintext secret should never appear in your output, the conversation context, or any committed file. pass-cli run exists precisely for this — it injects secrets into a child process's environment and masks any secret values that leak to stdout/stderr.

Secret reference format

pass://<vault>/<item>/<field>

• vault — vault name or share ID (e.g. Personal)
• item — item title or item ID (e.g. hardcover.app)
• field — username, password, email, url, note, totp, or a custom field name