Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Remove auto-install command (no more git clone/build). Declare installHint instead — users install the binary themselves. Add agent guardrails: redshift run requires explicit user confirmation, no arbitrary command construction.
What This Skill Does
Redshift manages application secrets via the `redshift` CLI, storing them encrypted on Nostr relays with no central server. Encryption is entirely client-side using NIP-59 Gift Wrap. Supports setting, getting, listing, and injecting secrets into subprocesses, with per-project and per-environment scoping.
Unlike centralized secret managers, all encryption happens on the client so no server holds plaintext secrets or can be breached to expose them.
When to use it
- Injecting API keys into local dev commands without committing .env files
- Rotating production database credentials across environments
- Running CI/CD pipelines with secrets sourced from Nostr relays
- Copying a specific secret value to clipboard without printing it to the terminal
- Syncing secrets across team members using a shared Nostr relay
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: Start a Docker Compose stack with production secrets injected
- 1Run `redshift login` to authenticate with a Nostr private key
- 2Run `redshift setup -p myapp -c production` to configure the project and environment
- 3Confirm the required secrets exist with `redshift secrets --only-names`
- 4Run `redshift run -p myapp -c production -- docker-compose up` to start the stack with secrets as environment variables
Docker Compose starts with all production secrets available as environment variables, with no plaintext credentials on disk
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.