Skip to content
Get packs

Guide · Agent skill

How to use the Configuring HSM Key Storage agent skill

Updated · written with AI from the project's own documentation and checked against our catalogue data

This guide explains the Configuring HSM Key Storage agent skill, a set of instructions and helper scripts that lets an AI agent walk you through setting up a Hardware Security Module (HSM) for cryptographic key storage. It is written for readers who have never used an agent skill before. By the end you will know what the skill does, how to install it, how to ask for help with natural requests, and what safety limits apply.

Configuring HSM Key Storagemukul975/Anthropic-Cybersecurity-Skills · Apache-2.0

Quick start

  1. 1Download the ZIP. Get the skill ZIP from the directory page for configuring-hsm-for-key-storage.
  2. 2Unzip into a skills folder. Place the folder in ~/.claude/skills/ for personal use, or in the project's .claude/skills/ folder for one project.
  3. 3Or upload it in the apps. In the Claude apps, open Settings, go to Capabilities, then Skills, and upload the skill.
  4. 4Install the Python packages. Install python-pkcs11 and, if you need AWS listing, boto3 with pip.
  5. 5Install SoftHSM2. Install SoftHSM2 on your system using the instructions on the SoftHSM project site.
  6. 6Ask for a task. Describe what you want in plain language, such as setting up a SoftHSM2 token or generating an AES key.
  7. 7Check the results. Confirm the keys are generated inside the HSM and cannot be exported, using the skill's validation checklist.

What does the Configuring HSM Key Storage skill do?

An HSM is a tamper-resistant physical device that protects cryptographic keys and performs cryptographic operations inside a hardened boundary. Keys stored in an HSM never leave the device, which is the main reason organisations use one. This skill guides the agent through configuring an HSM using the PKCS#11 standard interface, covering key generation, signing, encryption and key management.

The skill supports both physical HSMs and SoftHSM2, a software PKCS#11 implementation intended for development and testing. The source describes it as educational, so treat its output as a starting point rather than a finished production design.

  • Configure SoftHSM2 as a development PKCS#11 provider
  • Generate AES and RSA keys inside the HSM
  • Sign, verify, encrypt and decrypt with HSM-resident keys
  • List stored key objects
  • Use helper scripts that can list AWS CloudHSM clusters and run PKCS#11 operations

What do you need before you install it?

You need Python 3 at the minimum version the skill specifies, the python-pkcs11 and asn1crypto Python packages, and SoftHSM2 installed on your system (or access to a physical or cloud HSM). The AWS listing functions also need the boto3 package and AWS credentials.

Use a test or lab environment for your first run, and make sure you have authorization for any testing you do.

  • Python 3 at the version the skill specifies
  • python-pkcs11 and asn1crypto Python packages
  • SoftHSM2 installed locally, or a physical or cloud HSM
  • boto3 and AWS credentials, only if you use the CloudHSM listing functions

How do you install the skill?

Download the skill ZIP from the directory page. Then unzip it into one of two locations. For a personal install, put the unzipped folder in your user skills directory at ~/.claude/skills/. For a single project, put it in that project's .claude/skills/ folder.

If you use the Claude apps instead, open Settings, go to Capabilities, and upload the skill under Skills.

  • Personal install: unzip into ~/.claude/skills/
  • Project install: unzip into the project's .claude/skills/ folder
  • Claude apps: Settings → Capabilities → Skills, then upload the skill

Install the Python packages the scripts use

The reference file lists two packages with their install commands. Run these in the Python environment you plan to use. Install boto3 only if you intend to use the AWS CloudHSM functions.

SoftHSM2 is installed separately. The source points to the SoftHSM project site for downloads and documentation, so follow the instructions there for your operating system.

pip install python-pkcs11

How do you trigger the skill with a natural request?

You do not need to type a command or name the skill. Describe the task in plain language and the agent will load the skill when your request matches its description, which covers configuring HSMs for key storage, PKCS#11 workflows, and SoftHSM2 for development.

Be specific about your goal and your environment. Say whether you are using SoftHSM2 or a physical or cloud HSM, and what you want the keys to do. The skill is most useful when your request involves keeping keys inside a device boundary.

  • I want to set up SoftHSM2 with a token and user PIN for a signing workflow.
  • Show me how to generate an AES key inside an HSM with PKCS#11 and confirm it is non-extractable.
  • Help me list the keys stored in my test HSM and check that they cannot be exported.
  • Walk me through encrypting and decrypting a file using an HSM-resident key.

What safety limits should you know about?

The skill runs scripts and uses the network. The scripts can read cloud infrastructure details and perform key operations, so only run them against systems you are authorised to use. Do not run them against live production HSMs or cloud accounts without authorisation.

The skill is educational and the scripts are demonstrations. Production key ceremonies and certificate authority root key handling need review by a qualified security professional. The skill's own security notes say never to export private keys from the HSM, to use separate slots or partitions for different applications, and to enable audit logging for HSM operations.

Its validation checklist includes confirming that keys cannot be exported, which you can use to check your setup.

  • Test against SoftHSM2 or a lab device first
  • Never run the scripts against production HSMs or cloud accounts without authorisation
  • Keep private keys non-extractable (CKA_EXTRACTABLE set to False)
  • Enable audit logging and plan backup and disaster recovery

What people use it for

  • Setting up a SoftHSM2 development token before moving a signing workflow to a physical HSM
  • Generating AES and RSA keys inside an HSM so application code never holds the raw key
  • Reviewing whether a team's key storage approach lines up with FIPS 140-2 level expectations
  • Listing AWS CloudHSM clusters in an authorised lab account as part of planning a cloud HSM setup

Frequently asked questions

Is the Configuring HSM Key Storage skill free?

The skill is published under the Apache-2.0 licence, which the source lists. Check the licence text in the download for the full terms. The source does not state pricing, and the skill itself does not require a paid service, though cloud HSMs you use with it may have their own costs.

What do I need to run this skill?

You need Python at the version the skill specifies, the python-pkcs11 and asn1crypto packages, and SoftHSM2 on your system or access to a physical or cloud HSM. boto3 and AWS credentials are needed only for the CloudHSM listing functions.

How do I install an agent skill?

Download the ZIP and unzip it into ~/.claude/skills/ for personal use or a project's .claude/skills/ folder. In the Claude apps, you can instead upload it under Settings, then Capabilities, then Skills.

Can I use this skill without a physical HSM?

Yes. The skill covers SoftHSM2, a software PKCS#11 implementation meant for development and testing. It is a practical way to learn the workflow before using hardware.

Does the skill run code on my computer?

Yes. The skill includes scripts and uses the network. The scripts can read cloud infrastructure details and perform key operations, so run them only in environments you are authorised to use.

Is this skill enough for a production key management system?

No. The skill is educational and its scripts are demonstrations. Production key ceremonies and CA root key handling should be reviewed by a qualified security professional.

New agent skills, repos and AI tools — every week

The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.

Our verdict

This skill suits developers building key management or signing workflows who want keys to stay inside an HSM, and security engineers who want a SoftHSM2 test environment before moving to hardware or cloud HSMs. It is a poor fit for production key ceremonies, CA root keys, or any live HSM or cloud account you have not been authorised to test. For those, use a qualified security professional and a formal review process.

Download the skill