# Credentials

Instructions for handling API keys and credentials safely, verifying their presence...

- Repository: https://github.com/google-deepmind/science-skills (3377 stars)
- Category: Engineering
- License: Apache-2.0
- Last updated: 2026-10-23
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add google-deepmind/science-skills --skill credentials -g -a claude-code -y`
Codex: `npx skills add google-deepmind/science-skills --skill credentials -g -a codex -y`
Cursor: `npx skills add google-deepmind/science-skills --skill credentials -g -a cursor -y`
Gemini CLI: `npx skills add google-deepmind/science-skills --skill credentials -g -a gemini-cli -y`

## Description

Instructions for handling API keys and credentials safely, verifying their presence, and prompting the user to add them if missing using a safe protocol.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Safe Credentials Protocol

Many skills require API keys or other credentials to function or to access
higher rate limits. This skill defines the standard safe credentials protocol
for verifying and prompting for these credentials without leaking sensitive keys
into the agent context or the conversation history.

## Safe Verification (No Leaks)

As soon as a skill that requires a credential or API key looks relevant to the
user's request, you **MUST** immediately verify if the credential is present in
the `.env` file (typically located in your home directory `~/.env` or the
project root), **before doing any other work** for that skill.

**CRITICAL**: You must verify the presence of the credential *without* printing
its value to the terminal or reading it into your context.

### How to verify:

Use `grep` in quiet and suppress-errors mode (`-sq`) to check if the variable is
defined in `~/.env`. The `-s` flag ensures the command works cleanly even if
`~/.env` does not exist yet.

```bash
grep -sq "^CREDENTIAL_NAME=" ~/.env
```

Replace `CREDENTIAL_NAME` with the actual credential name required by the
calling skill (e.g., `ALPHAGENOME_API_KEY` or `USER_EMAIL`).

-   If the command **succeeds** (exit code 0), the credential is present. You
    can proceed.
-   If the command **fails** (any non-zero exit code, whether the credential is
    missing or the `.env` file does not exist yet), the credential is missing.
    You **MUST IMMEDIATELY** stop and prompt the user to add it using the
    instructions in
    [Prompting the User to Add Credentials](#prompting-the-user-to-add-credentials)
    before attempting to run any scripts or tools. Do not conclude the turn by
    simply stating that the key is missing.

The rest: https://github.com/google-deepmind/science-skills/blob/HEAD/skills/credentials/SKILL.md