Skip to content
Get packs

Credential Binding for Smolvm Machines

Lets an agent call an API with your key inside a smolvm machine without the machine ever holding the key, and proves it

Source Download skill
Repository
smol-machines/smolvm
Stars
6,901
Licence
Apache-2.0
Files
8 files

What it does

When an AI agent or untrusted code runs inside an isolated smolvm virtual machine and needs to call an API with your secret key, this skill sets up the machine so it only sees a placeholder. The real key is attached on the host as requests leave, and only for the one host you name. It also provides scripts that check the key never appears inside the machine, its records, or smolvm's database.

Great for

  • Developers running agent or untrusted code in smolvm machines that must call a third-party API
  • Teams that need evidence a secret stayed out of a sandbox
  • People deciding between a credential binding and passing a secret as an environment variable

Skip it if

  • Values the program must read and parse, such as a database URL; the skill says to use --secret-env instead because the binding only substitutes headers
  • Git or SSH keys; the skill says SSH agent forwarding is the right tool
  • Workloads that can replace grep or other tools inside the guest, since the containment check runs grep in the guest and could be tampered with if the workload runs first

Try asking

  • “Let my agent call the GitHub API from a smolvm machine without giving it my token”
  • “Check that my API key never got written into the sandbox or its logs”
  • “Set up a smolvm machine bound to api.example.com with my API_TOKEN variable”
  • “Why am I getting a 403 or 502 from smolvm when my sandboxed request runs?”
Step-by-step guide: how to use Credential Binding for Smolvm MachinesInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 8 original files, the Apache-2.0 licence and an attribution note.

    credentials.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip credentials.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip credentials.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Run preflight.sh first and only proceed when it prints result=ready, and keep the API variable exported in every shell that runs the scripts.
  • Run verify-containment.sh on the new machine before any untrusted workload runs in it, since its check briefly hands the value to a grep inside the guest.
  • Run cleanup.sh --purge when finished; it only deletes machines the scripts recorded, so hand-made machines are left alone.

What's inside

  • README.md
  • references/platforms.md
  • references/traps.md
  • scripts/cleanup.sh
  • scripts/create-credentialed.sh
  • scripts/preflight.sh
  • scripts/verify-containment.sh
  • SKILL.md

Redistributed unmodified from smol-machines/smolvm under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-11-02. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.