Send Secret File

Share files securely using P2P encrypted links. Files are encrypted locally with AES-256-GCM and served via a temporary Cloudflare tunnel. The decryption key is embedded in the URL fragment (never sent to servers).

Security Model for Agentic Use

Critical constraint: The agent must NEVER read or display file contents.

Command Reference

# Basic file send (single recipient, no timeout)
npx send-secret <filepath>

# Multiple recipients
npx send-secret -n <count> <filepath>

# Auto-destruct timeout (seconds)
npx send-secret -t <seconds> <filepath>

# Combined: 3 views OR 5 minutes, whichever first
npx send-secret -n 3 -t 300 <filepath>

Workflow

1. Verify file exists (use test -f or ls, never cat or Read)
2. Confirm options with user:

- How many people need access? (default: 1) - Should it expire? (default: no timeout)

1. Run command with file path argument
2. Extract and provide URL from output to user
3. Inform user to keep terminal open until recipient retrieves

Output Parsing

The CLI outputs a boxed URL like:

╭ Share this link ─────────────────────────╮
│ https://xyz.trycloudflare.com/s/abc#key=... │
╰──────────────────────────────────────────╯

Extract the full URL including the #key=... fragment. The fragment contains the decryption key and is essential.

Process Lifecycle

The send-secret process runs interactively:

• Stays alive waiting for recipient(s)
• Shows progress: Waiting for receiver... (0/3)
• Shows retrieval: Retrieved (1/3) from 73.162.45.99
• Exits when all views used or timeout reached
• Can be cancelled with Ctrl+C

Important: The process must stay running until delivery completes. Run in foreground, not background.

Common Scenarios

Single recipient, no timeout

npx send-secret ./credentials.json

Team onboarding (multiple people)

npx send-secret -n 5 ./team-secrets.env

Time-sensitive sharing

npx send-secret -t 300 ./temp-access.json  # 5 minute window

High security (limited views + timeout)

npx send-secret -n 2 -t 120 ./api-keys.txt  # 2 views max, 2 min timeout

Error Handling

What NOT To Do

# NEVER pipe file contents
cat secret.json | npx send-secret  # WRONG: agent sees content

# NEVER read file first
Read secret.json, then send  # WRONG: agent sees content

# NEVER echo secrets
echo "sk_live_xxx" | npx send-secret  # WRONG: agent sees secret

# NEVER commit secret files or send-secret URLs to git
git add .  # WRONG: may include secret files

Example Interaction

User: "I need to share my .env file with the new developer"

Agent:

1. Verify file: test -f ./.env && echo "File exists"
2. Ask: "How many people need access? Should it expire?"

User: "Just one person, no timeout needed"

Agent:

npx send-secret ./.env

Response: "Here's your secure link: [URL]. Share this with the developer. Keep this terminal open until they retrieve it - the link is single-use and self-destructs after viewing."

Related Skills

• receive-secret - For receiving secrets from send-secret URLs
• send-secret-clipboard - For sharing clipboard contents (macOS)