Keychain Access Skill

Manage macOS Keychain items in a safe, scriptable way. Use the bundled keychain-access/keychain-access.sh helper for all operations: it wraps security calls, enforces confirmations for updates and deletions, masks secrets unless explicitly requested, and supports dry-run previews.

Safety Constraints

• Never print secrets unless the user explicitly asks to reveal them (--raw). Routine get calls only report metadata with the password hidden.
• Ask the user to confirm before modifying or deleting existing entries. The script prompts by default and accepts --yes to skip the prompt for automation.
• Support a --dry-run mode so agents can preview the security command without touching the Keychain.
• Supply secrets via --password-stdin, --password-env, or the hidden interactive prompt. The legacy --password option leaves values in shell history and process listings (the helper warns when it's used), so prefer the safer inputs; --password-env VAR reads the var and unsets it immediately to keep the secret out of the environment.
• Operate on a specific keychain when provided (--keychain); otherwise, the default search list is used. Avoid leaking system passwords by defaulting to explicit service/account filters.

Supported Operations