diff --git a/single-scripts/get-secret.ts b/single-scripts/get-secret.ts
new file mode 100755
index 0000000..7334440
--- /dev/null
+++ b/single-scripts/get-secret.ts
@@ -0,0 +1,27 @@
+#!/usr/bin/env -S deno run -A
+
+import {args, exit, getSecretValue,} from "https://script.hatter.ink/@61/deno-commons-mod.ts";
+import {parseArgs} from "jsr:@std/cli/parse-args";
+
+const flags = parseArgs(args(), {
+    boolean: ["help"],
+    string: ["id"],
+});
+
+if (flags.help) {
+    console.log(
+        "export RUN_ENV=ALIBABA_CLOUD or `echo ALIBABA_CLOUD > ~/.config/envs/RUN_ENV` runs on Alibaba Cloud ECS or light server",
+    );
+    console.log(
+        "get-secret.ts --id ID",
+    );
+    exit(0);
+}
+
+if (flags.id) {
+    console.log(await getSecretValue(flags.id));
+    exit(0);
+} else {
+    console.error("get-secret.ts --id is required");
+    exit(1);
+}