Automic Vault

brew package intelligence

skopeo

Automic Vault tracks skopeo because plain text skopeo registry credentials matters when AI agents run command-line tools on macOS.

Read docs Run scanner

overview

What Automic Vault knows about skopeo

Work with remote images registries

Homepage

Not present in the local metadata.

Commands and aliases

No executable aliases were found in the local package database.

radioisotope

Plain Text Skopeo Registry Credentials

skopeo login stores registry credentials in the containers auth file. On macOS, that package-owned plaintext path is ~/.config/containers/auth.json. Our isotope stores the auth file in the macOS keychain and injects it via REGISTRY_AUTH_FILE while `skopeo` runs.

Local README excerpt

Skopeo Radioisotope

skopeo login stores container registry credentials in the containers auth file. On macOS, the package-owned plaintext path is ~/.config/containers/auth.json.

The radioisotope moves that auth file into the macOS keychain and rewrites the auth file to non-secret credHelpers entries. The wrapper places a temporary docker-credential-av-skopeo shim on PATH and allows Skopeo to fetch credentials through av credential-helper skopeo.

Caveats

  • Only ~/.config/containers/auth.json is migrated.
  • Docker's shared ~/.docker/config.json and legacy .dockercfg are not

migrated.

  • Passing an explicit --authfile can bypass the helper-backed auth file.
  • Direct execution of the original binary will not receive the helper shim.

Source: data/radioisotopes/skopeo/README.md

Caveats

  • Only ~/.config/containers/auth.json is migrated.
  • Docker's shared ~/.docker/config.json and legacy .dockercfg are not migrated.
  • Explicit --authfile arguments bypass the injected keychain-backed auth file.
  • Runtime login/logout changes are not persisted back to keychain.
  • Direct execution of the original binary will not receive credentials.

install metadata

Resolver facts

Package keybrew:skopeo
Last updated2026-04-14T18:22:36Z
Pulseupdated

source trail

Generated from repository data

This page is regenerated by scripts/generate-pkg-pages.py. Deployments refuse to publish if www/pkg/ is stale relative to local package data.

Used sources

  • Nucleus package database
  • local isotope README
  • radioisotope security manifest