Could I use this to store secrets to hide env vars from agents?

Definitely … agents cannot access your password unless you save it to the environment too. However it's better to use resolvers ... depending on your use case