totp-secret-store

Decide where a TOTP seed and its backup codes live, put them there, and prove they are not in git. Fixes the failures that actually burn people: a seed committed because .gitignore does not apply to already-tracked files, secrets passed as command arguments and captured by ps and shell history, backup codes reused after they were spent, and "I deleted the file" treated as remediation for a published secret.

When NOT to use

• Producing a code from a secret → totp-generate.
• The seed lives in 1Password / Bitwarden / Vault / 2FAuth and you never hold it → totp-provider-api.
• Serving codes to MCP clients → totp-mcp-server. Driving a login → login-2fa-flow.
• Generic secret handling (API keys, .env, cloud credentials) — not 2FA-specific, and no reason to load this skill.

Say this once, plainly