功能描述

Store, retrieve, list, and manage secrets using gopass (the team password manager). Use when the user asks to save credentials, look up passwords, generate secrets, manage password entries, or interact with a gopass password store. Covers CRUD operations, secret generation, TOTP, recipients, mounting stores, and clipboard operations.

使用说明 (SKILL.md)

gopass Skill

Name: gopass
Author: erdgeclaw

gopass is a CLI password manager for teams, built on GPG and Git.

Prerequisites

gopass binary installed
GPG key available (gopass uses GPG for encryption)
Store initialized (gopass init or gopass setup)

Common Operations

List secrets

gopass ls
gopass ls -f          # flat list

Show a secret

gopass show path/to/secret           # full entry (password + metadata)
gopass show -o path/to/secret        # password only
gopass show -c path/to/secret        # copy to clipboard
gopass show path/to/secret key       # show specific field

Create / Update

gopass insert path/to/secret         # interactive
gopass edit path/to/secret           # open in $EDITOR
echo "mypassword" | gopass insert -f path/to/secret   # non-interactive

Add key-value metadata below the first line (password):

mysecretpassword
username: erdGecrawl
url: https://github.com
notes: Created 2026-01-31

Generate passwords

gopass generate path/to/secret 24           # 24-char password
gopass generate -s path/to/secret 32        # with symbols
gopass generate --xkcd path/to/secret 4     # passphrase (4 words)

Delete

gopass rm path/to/secret
gopass rm -r path/to/folder          # recursive

Move / Copy

gopass mv old/path new/path
gopass cp source/path dest/path

Search

gopass find github                   # search entry names
gopass grep "username"               # search entry contents

Store Management

Initialize

gopass setup                         # guided first-time setup
gopass init \x3Cgpg-id>                 # init with specific GPG key

Mount sub-stores

gopass mounts add work /path/to/work-store
gopass mounts remove work
gopass mounts                        # list mounts

Sync (git push/pull)

gopass sync

Recipients (team access)

gopass recipients                    # list
gopass recipients add \x3Cgpg-id>
gopass recipients remove \x3Cgpg-id>

TOTP

gopass otp path/to/secret            # show current TOTP code

Store TOTP URI as totp: otpauth://totp/... in the entry body.

Non-interactive Tips

Use echo "pw" | gopass insert -f path for scripted inserts
Use gopass show -o path for machine-readable password-only output
Use gopass show -f path to suppress warnings
Set GOPASS_NO_NOTIFY=true to suppress desktop notifications
Use gopass --yes to auto-confirm prompts

安全使用建议

This skill appears coherent and does only what a gopass CLI helper should do, but it will cause the agent to run commands that access your local secrets. Before installing or allowing use: - Only use with agents you trust to run local commands. The agent will run gopass commands that read/write secrets and may copy them to the clipboard. Clipboard contents can be leaked or persisted by other software. - Be aware that gopass sync uses git: running sync may push/pull secrets to configured git remotes. Verify your gopass store's remote configuration. - The skill assumes you have gopass and GPG keys set up locally; it does not install them. Ensure those tools are installed and configured as you expect. - Piping secrets into commands or using non-interactive inserts can expose secrets in shell history or logs — prefer secure workflows. - The skill source is unknown; since it is instruction-only, review the SKILL.md content (already consistent) and exercise least privilege when granting agent execution rights. If you need broader assurance, require a vetted install spec or limit the agent's ability to run system commands that touch your credential stores.

功能分析

Type: OpenClaw Skill Name: gopass Version: 1.0.0 The skill bundle is benign. It provides instructions for an AI agent to interact with the `gopass` password manager. All commands and descriptions in `SKILL.md` are directly related to the legitimate functionality of `gopass` for managing secrets, including listing, showing, inserting, generating, and synchronizing passwords. There is no evidence of prompt injection attempting to subvert the agent's behavior, no instructions for data exfiltration, malicious execution, persistence, or obfuscation. The inherent sensitivity of handling secrets with `gopass` is aligned with the skill's stated purpose.

能力评估

✓ Purpose & Capability

The name/description match the SKILL.md: it documents gopass CLI usage (CRUD, generate, TOTP, recipients, mounts, sync). Prerequisites (gopass binary, GPG key, initialized store) are appropriate for this purpose.

ℹ Instruction Scope

Instructions are limited to running gopass CLI commands (show, insert, generate, rm, sync, mounts, otp, etc.). These commands access local password stores, may copy secrets to clipboard, open $EDITOR, or run git sync operations — all expected for a password-manager helper but they do operate on sensitive local data and may push/pull to configured git remotes.

✓ Install Mechanism

No install spec or code is provided (instruction-only). Nothing is downloaded or written by the skill itself — the agent will rely on an existing gopass/GPG installation.

ℹ Credentials

The skill declares no required env vars or credentials, which is appropriate. The documentation references $EDITOR and GOPASS_NO_NOTIFY and expects a GPG key and git remotes; those are legitimate runtime prerequisites but they are not requested as explicit credentials by the skill.

✓ Persistence & Privilege

always:false and no install/auto-enable behavior. The skill can be invoked by the agent (normal), but it does not request persistent system-level privileges or modify other skills' configs.

版本历史

v1.0.0

Initial release: CRUD, search, generate, TOTP, store management, non-interactive tips

元数据

Slug gopass

版本 1.0.0

许可证 —

累计安装 1

当前安装数 1

历史版本数 1

常见问题

gopass 是什么？

Store, retrieve, list, and manage secrets using gopass (the team password manager). Use when the user asks to save credentials, look up passwords, generate secrets, manage password entries, or interact with a gopass password store. Covers CRUD operations, secret generation, TOTP, recipients, mounting stores, and clipboard operations. 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 1675 次。

如何安装 gopass？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install gopass」即可一键安装，无需额外配置。

gopass 是免费的吗？

是的，gopass 完全免费（开源免费），可自由下载、安装和使用。

gopass 支持哪些平台？

gopass 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 gopass？

由 erdGeclaw（@erdgeclaw）开发并维护，当前版本 v1.0.0。

gopass