Confidential

---
name: confidential
description: >-
  Use when encrypting, decrypting, signing, or managing confidential
  content. Smart routing across three tools: cryptoid for Hugo site
  encryption, pagevault for HTML and file encryption, and gpg for
  file-level encryption and signing.
---

# Confidentiality Toolkit

Smart routing across three complementary encryption tools. Pick the right tool based on what
needs protecting, apply it, and optionally sign the result.

## Tool Selection

| Signal | Tool | Why |
|--------|------|-----|
| Hugo site, markdown content, `_index.md` cascade, `.cryptoid.yaml` | **cryptoid** | Multi-user/group whole-page encryption integrated with Hugo build |
| HTML files, static site output, arbitrary files for web delivery, `<pagevault>` tags | **pagevault** | Section-level or whole-file encryption, self-contained HTML output with viewers |
| Offline encryption, signing, key exchange, `.gpg` files, asymmetric crypto | **gpg** | Standard file encryption, detached signatures, public key infrastructure |

### Decision Tree

```
Is the target Hugo MARKDOWN content (files under content/)?
  YES -> cryptoid
  NO  -> Is this HTML, built site output, assets (PDFs, images), or files
         meant for browser viewing?
    YES -> pagevault
    NO  -> gpg
```

Note the Hugo carve-out: cryptoid encrypts markdown content only. Hugo assets
(PDFs, images in static/) and built HTML output go to pagevault, even on a
Hugo site.

Override: the user may explicitly name a tool regardless of context. Honor that.

### Compound Workflows

Some tasks require multiple tools in sequence:

- **Encrypt and sign**: Encrypt with cryptoid or pagevault first, then `gpg --detach-sign` the output
- **Verify then decrypt**: `gpg --verify` the signature, then `pagevault unlock` or `cryptoid decrypt`
- **Web delivery + archival**: `pagevault lock` for browser access, `gpg -e` the original for offline backup

## cryptoid — Hugo Site Encryption

Encrypts whole markdown pages for Hugo static sites. Multi-user access control with
group-based permissions and directory cascade via `_index.md`.

**Key concepts**: `.cryptoid.yaml` config (users/groups/salt), `encrypted: true` front matter,
cascade from `_index.md`, admin group gets universal access, `_index.md` bodies are encrypted
(front matter stays readable).

### Essential Commands

```bash
cryptoid init                                    # Interactive config setup
cryptoid protect content/private/ --groups team  # Cascade-encrypt a directory
cryptoid protect content/doc.md --groups admin   # Encrypt a single file
cryptoid protect -i                              # Interactive TUI selector
cryptoid unprotect content/private/              # Remove encryption marking
cryptoid encrypt --content-dir content/          # Encrypt marked files
cryptoid encrypt --content-dir content/ --dry-run
cryptoid decrypt --content-dir content/          # Restore plaintext
cryptoid status --content-dir content/ --verbose # Show encryption state
cryptoid rewrap --content-dir content/           # Re-wrap after user changes
cryptoid rewrap --rekey                          # New CEK for forward secrecy
cryptoid validate --content-dir content/         # Pre-build health check
cryptoid hugo install                            # Install shortcode + JS
```

### User/Group Management

```bash
cryptoid config list-users
cryptoid config add-user USERNAME [--group GROUP]
cryptoid config remove-user USERNAME
cryptoid config list-groups
cryptoid config add-group NAME [--members alice,bob]
cryptoid config remove-group NAME
cryptoid config generate-salt [--apply]
```

For detailed reference: **`${CLAUDE_PLUGIN_ROOT}/skills/confidential/references/cryptoid.md`**

## pagevault — HTML/File Encryption

Encrypts regions within HTML or wraps arbitrary files (PDF, images, text, markdown) into
self-contained encrypted HTML with built-in viewer plugins. Works with any static site.

**Key concepts**: `<pagevault>` tags for section-level encryption, `.pagevault.yaml` config,
self-contained output (HTML+JS+CSS all inline), viewer plugins for different file types,
multi-user support.

### Essential Commands

```bash
pagevault lock page.html                  # Encrypt marked regions
pagevault lock report.pdf                 # Wrap file with viewer
pagevault lock site/ --site               # Bundle entire site
pagevault lock page.html -s "#secret"     # Encrypt only matching selector
pagevault unlock _locked/page.html        # Decrypt back
pagevault mark page.html -s ".private"    # Add encryption tags
pagevault inspect encrypted.html          # Show metadata without password
pagevault config init                     # Create .pagevault.yaml
pagevault sync _locked/ -r               # Re-wrap keys after adding/removing users (multi-user configs only)
```

For detailed reference: **`${CLAUDE_PLUGIN_ROOT}/skills/confidential/references/pagevault.md`**

## gpg — File Encryption and Signing

Standard GNU Privacy Guard for offline file encryption, digital signatures, and key management.
Use for non-web scenarios or to sign outputs from cryptoid/pagevault.

### Essential Commands

```bash
# Symmetric encryption (password-based)
gpg -c --cipher-algo AES256 file.txt           # Encrypt with passphrase
gpg -d file.txt.gpg > file.txt                 # Decrypt

# Asymmetric encryption (key-based)
gpg -e -r recipient@email.com file.txt         # Encrypt for recipient
gpg -d file.txt.gpg > file.txt                 # Decrypt with your key

# Signing
gpg --detach-sign file.txt                     # Create file.txt.sig
gpg --verify file.txt.sig file.txt             # Verify signature
gpg --clearsign message.txt                    # Inline signature

# Key management
gpg --list-keys                                # List public keys
gpg --list-secret-keys                         # List private keys
gpg --gen-key                                  # Generate new key pair
gpg --export -a "Name" > public.key            # Export public key
gpg --import public.key                        # Import someone's key
```

For detailed reference: **`${CLAUDE_PLUGIN_ROOT}/skills/confidential/references/gpg.md`**

## Additional Resources

### Reference Files

For detailed usage, configuration, and troubleshooting:
- **`${CLAUDE_PLUGIN_ROOT}/skills/confidential/references/cryptoid.md`** — Full cryptoid reference (config format, cascade rules, front matter options, build workflow, security model)
- **`${CLAUDE_PLUGIN_ROOT}/skills/confidential/references/pagevault.md`** — Full pagevault reference (config format, viewers, selectors, site bundling, multi-user)
- **`${CLAUDE_PLUGIN_ROOT}/skills/confidential/references/gpg.md`** — GPG reference (key management, trust model, batch operations, common recipes)