Skip to content
SkillCheatSheet Sign in

credentials

An AI agent skill from smol-machines/smolvm, scored 56 out of 100 by code.

56/ 100C

Code score by group

  • Spec20/20
  • Description11/20
  • Procedure0/15
  • Done criteria4/15
  • Resources8/10
  • Scripts7/8
  • Safety3/7
  • Upkeep3/5

It loses the most points in Procedure (15), the group that checks whether the steps are numbered, read the context first and say what to do when something fails.

What the author says it does

Gives a workload in a smolvm machine an API key or token it can use but never read, by binding the credential to named HTTPS hosts so the guest holds only a placeholder and the host substitutes the value on the way out, then proves on the host that the value never entered the machine. Use when an agent or untrusted code inside a machine has to call an API with your key; when deciding between a credential binding and --secret-env; when a request from a credentialed machine comes back 403 or 502 from smolvm itself; or when you need evidence that a key stayed out of a machine. Do not use it for…

This is the description in the skill's own SKILL.md, written by its author, not by SkillCheatSheet.

Repository
smol-machines/smolvm
Folder
docs/credentials
License
Apache-2.0
GitHub stars
7,092
SKILL.md lines
281
Other files
7

Add credentials to your agent

npx skills add smol-machines/smolvm --skill credentials

The command uses the open skills CLI. A skill is instructions and scripts your agent will follow, so read it first: open the folder on GitHub at the commit that was scored.

More skills from smol-machines/smolvm

  1. throwaway-machine

    Runs untrusted code in a throwaway smolvm microVM against a repo it must not modify, with no network unless explicitly granted, and collects artifacts from a writable output direc…

    72B
  2. install

    Installs smolvm from a published release and proves the host can actually boot a microVM before any other work starts. Use when setting smolvm up on a new machine, a CI runner or…

    71B
  3. docker-in-machine

    Runs a Docker daemon inside a smolvm machine and shows it working there, which is what tools that call Docker themselves need, such as a test suite that starts containers, an imag…

    65C
  4. local-api

    Drives smolvm programmatically over its local HTTP API (smolvm serve) instead of the CLI: create machines, exec and stream commands, move files in and out, and tear them down. Use…

    65C
  5. teardown

    Stops every smolvm machine a session started, removes smolvm's state, and proves the host is clean. Use after any smolvm session; when a machine seems to have survived a Ctrl-C or…

    65C
  6. dev-env

    Keeps a persistent smolvm machine with its dependencies already installed and re-enters it cheaply across sessions. Use when a project needs an isolated development environment th…

    64C
  7. gpu-cuda

    Runs CUDA compute workloads inside a smolvm microVM against a real host NVIDIA GPU, using smolvm's --cuda API remoting. Use when a workload in a machine needs a GPU; when nvidia-s…

    64C
  8. pack

    Turns an image, or a machine already provisioned, into a single self-contained artifact that runs on another compatible host. Use when shipping a prepared environment as one file,…

    64C

All skills in smol-machines/smolvm

Scores come from a snapshot of 300 public GitHub repositories taken on 12 November 2026. Every score is the result of fixed checks run by code; no AI is involved. How scoring works.