← All skills
hq-secrets
94 / 100 · Low risk
Fine to try. Some of what it can do is expected: a security skill usually runs scanners and checks websites.
By indigoai-us/hq-core (GitHub) · security · 94 stars · scanned at commit 7ce1412
Use HQ CLI secrets safely through env injection or one-off exec.
Works with any agent that supports SKILL.md skills.
What this skill can do
Runs commands on your computer
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 22 places.
Show 17 more
- .claude/skills/hq-secrets/SKILL.md, line 128
hq secrets exec --only NOTION_TOKEN -- bash core/scripts/notion-upload-file.sh chart.png --attach-to <page-or-block-id> --caption "Weekly chart" - .claude/skills/hq-secrets/SKILL.md, line 138
source <(hq secrets env --only DATABASE_URL,API_KEY) - .claude/skills/hq-secrets/SKILL.md, line 165
hq secrets acl PROD/DB_PASSWORD - .claude/skills/hq-secrets/SKILL.md, line 182
hq secrets --personal set MY_GITHUB_PAT - .claude/skills/hq-secrets/SKILL.md, line 231
hq groups create grp_backend-team --name "Backend team" - .claude/skills/hq-secrets/SKILL.md, line 254
if hq secrets generate-link --help 2>/dev/null | grep -q -- '--format'; then - .claude/skills/hq-secrets/SKILL.md, line 292
hq run -- npm run deploy - .claude/skills/hq-secrets/SKILL.md, line 297
hq secrets exec --only DATABASE_URL,REDIS_URL -- npm run deploy - .claude/skills/hq-secrets/SKILL.md, line 304
hq run -- npm test - .claude/skills/hq-secrets/SKILL.md, line 309
hq secrets exec --only STAGING_API_KEY -- npm test - .claude/skills/hq-secrets/SKILL.md, line 315
if hq secrets generate-link --help 2>/dev/null | grep -q -- '--format'; then - .claude/skills/hq-secrets/SKILL.md, line 332
hq secrets list --company myco - .claude/skills/hq-secrets/SKILL.md, line 338
echo "$VALUE" | hq secrets set NEW_SECRET --from-stdin - .claude/skills/hq-secrets/SKILL.md, line 344
hq secrets cache clear - .claude/skills/hq-secrets/SKILL.md, line 350
hq secrets share PROD/DB_PASSWORD --with alice@example.com --permission read - .claude/skills/hq-secrets/SKILL.md, line 356
hq secrets acl PROD/DB_PASSWORD - .claude/skills/hq-secrets/SKILL.md, line 362
hq groups create grp_backend-team --name "Backend team"
and 2 more places
Sends data to these websites: api.notion.com, api.example.com
This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.
Found in 3 places.
Install
Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.
if [ -e ~/.agents/skills/'hq-secrets' ] || [ -L ~/.agents/skills/'hq-secrets' ]; then echo 'A skill folder named hq-secrets already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/indigoai-us/hq-core' "$d" && git -C "$d" checkout --quiet '7ce1412b413df51bc6bac69750c79468ab09c40c' -- '.claude/skills/hq-secrets' && mkdir -p ~/.agents/skills && cp -R "$d"/'.claude/skills/hq-secrets' ~/.agents/skills/'hq-secrets' && rm -rf "$d"; fi
Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'hq-secrets' ~/.claude/skills/'hq-secrets' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.
Badge for your README
The badge for indigoai-us/hq-core shows the score of its lowest-scoring skill.

[](https://zalavijaysinh.github.io/skilltrust/repos/indigoai-us/hq-core/)
Score history
| Date | Version | Score |
|---|
| 2026-11-13 | 7ce1412 | 94 |
| 2026-11-07 | 3e95070 | 94 |