المهارات using-sops
📦

using-sops

مراجعة المحتوى r1 حرج ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات🔑 متغيرات البيئة

Manage SOPS Secrets in Repositories

Encrypted repository secrets require careful commands, keys, and environment handling. This skill guides SOPS workflows through an existing pnpm secrets wrapper.

يدعم: Claude Codex Code(CC)
⚠️ 38 ضعيف

التثبيت باستخدام Agent لدي

انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.

طلب الوكيل
Review the Skillstore skill "using-sops" from https://skillstore.io/skills/jssblck-using-sops.md and its manifest at https://skillstore.io/api/skills/jssblck-using-sops/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.

موارد مهيّأة لـ Agents

استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.

تفاصيل Markdown GET /skills/jssblck-using-sops.md manifest موقَّع GET /api/skills/jssblck-using-sops/manifest lockfile موقَّع GET /api/skills/jssblck-using-sops/lockfile

اختبرها

جارٍ استخدام "using-sops". Retrieve the development Stripe key without showing other secrets.

النتيجة المتوقعة:

The assistant identifies the repository wrapper, requests confirmation, retrieves only the named value, and avoids echoing unrelated decrypted data.

جارٍ استخدام "using-sops". Add a required API endpoint to every accessible environment.

النتيجة المتوقعة:

  • The development secret and environment schema are updated.
  • Production remains unchanged because elevation is unavailable.
  • The deployment requirement is recorded for review.

جارٍ استخدام "using-sops". Rotate a lost production recipient.

النتيجة المتوقعة:

The assistant lists recipient replacement, file re-encryption, value rotation, deployment updates, verification, and encrypted history exposure.

التدقيق الأمني

حرج
v1 • ٢٣‏/٨‏/٢٠٢٦ فتح التقرير المرتبط بالإصدار

The skill intentionally grants agents broad access to encrypted development secrets and supports persistent production elevation. The most serious design stores a shared private key in persistent cloud environment variables, creating cross-project credential exposure.

4
الملفات التي تم فحصها
272
الأسطر التي تم تحليلها
8
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة

مخاوف أمنية مؤكدة (8)

حرج
references/setup.md:53-65references/sops-notes.md:51-56
Private Key Stored in Non-Secret Cloud Variables
The setup places a reusable age private key in persistent cloud environment variables, including fields documented as unsuitable for credentials. Redaction limitations are acknowledged.
The instructions explicitly require SOPS_AGE_KEY in persistent environment variables and state that one platform advises against credentials there.
مرتفع
SKILL.md:3
Environment file access
description: Use when a repo has .sops.yaml and secrets/<env>.env, or a pnpm secrets script. Covers
The skill's declared purpose includes reading and writing encrypted environment secrets. This is intentional sensitive-data access with substantial impact if misused.
مرتفع
SKILL.md:21
Environment file access
| `agent` | user-wide | `~/.config/sops/age/keys.txt` on every machine agents run on; `SOPS_AGE
The line places an age private key in SOPS_AGE_KEY for cloud agents. Environment exposure can reveal a credential that decrypts multiple projects.
مرتفع
SKILL.md:45
Environment file access
Prod secrets need elevation. When a task requires reading or writing `prod.env`:
The workflow enables reading and writing production secrets after elevation. This is a real high-impact capability even though user participation is required.
مرتفع
SKILL.md:54
Environment file access
When you add a variable, add it to the env schema and to every `secrets/<env>.env` you can
The instruction directs the agent to modify every decryptable environment secret file. A mistaken or malicious change can affect multiple deployments.
مرتفع
SKILL.md:32-40
Unprompted Bulk Development Secret Access
The skill authorizes agents to show, modify, delete, and execute with all development secrets without user confirmation. This can expose or corrupt credentials beyond the immediate task.
The instruction explicitly says agents may manage development secrets without asking and includes a command that reveals everything decrypted.
مرتفع
SKILL.md:21-28references/setup.md:49-51
Shared Cross-Project Decryption Identity
One agent private key is shared across every project and installed for all agent sessions. Compromise of one machine or session exposes every development file using that recipient.
Both files explicitly describe a user-wide identity shared by every project and accessible to any agent session on the machine.
مرتفع
SKILL.md:45-52references/setup.md:118-119
Persistent Production Elevation Artifact
Production elevation remains active until a checkout file is manually deleted. A stale or copied checkout can retain production decryption access longer than intended.
The workflow states that elevation persists until manual deletion and has no timeout, session binding, or automatic cleanup.
عناصر مراجعة القدرات (8)

هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.

مرتفع
references/setup.md:81
sudo privilege escalation
sudo mkdir -p /etc/credstore.encrypted
This command creates a root-owned system credential directory with sudo. It is legitimate administration, but it changes privileged host state.
مرتفع
references/setup.md:82
sudo privilege escalation
printf '%s' 'AGE-SECRET-KEY-1...' | sudo systemd-creds encrypt --name=age-prod - /etc/credstore.encr
This sudo command installs a production age private key as a system credential. Substituting the real key can expose it through shell history.
مرتفع
references/setup.md:13
Hardcoded URL
curl -fsSL https://github.com/FiloSottile/age/releases/download/v1.3.1/age-v1.3.1-linux-amd64.tar.gz
The command streams a remote archive directly into tar without integrity verification. A compromised response could write attacker-controlled files before review.
مرتفع
references/setup.md:44
Hidden file in home directory
install -m 600 /dev/stdin ~/.config/sops/age/keys.txt <<'EOF'
This instruction persists an age private key in the user's SOPS configuration. Mode 600 limits access, but every process running as that user can use the key.
مرتفع
references/setup.md:44
Hidden file access
install -m 600 /dev/stdin ~/.config/sops/age/keys.txt <<'EOF'
This instruction persists an age private key in the user's SOPS configuration. Mode 600 limits access, but every process running as that user can use the key.
مرتفع
SKILL.md:21
Hidden file in home directory
| `agent` | user-wide | `~/.config/sops/age/keys.txt` on every machine agents run on; `SOPS_AGE
The documented path stores a shared decryption key on every agent machine. Any agent process under that user can decrypt development secrets across projects.
مرتفع
SKILL.md:21
Hidden file access
| `agent` | user-wide | `~/.config/sops/age/keys.txt` on every machine agents run on; `SOPS_AGE
The skill explicitly relies on agents reading the user-wide SOPS key location. This grants broad filesystem-mediated access to development secrets.
متوسط
references/setup.md:11
Hardcoded URL
curl -fsSL -o ~/.local/bin/sops https://github.com/getsops/sops/releases/download/v3.13.3/sops-v3.13
The instructions download an executable from GitHub and immediately mark it executable without checksum or signature verification. A compromised release path could execute attacker code.

عوامل الخطر

⚙️ الأوامر الخارجية (25)
references/setup.md:81 references/setup.md:82 SKILL.md:9 SKILL.md:10 SKILL.md:14 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:25 SKILL.md:26 SKILL.md:27 SKILL.md:34-40 SKILL.md:40-42 SKILL.md:42-43 SKILL.md:43-45 SKILL.md:45-47 SKILL.md:47-49 SKILL.md:49-51 SKILL.md:51-54 SKILL.md:54-58 SKILL.md:58 SKILL.md:63 SKILL.md:65-68 SKILL.md:68-69 SKILL.md:69
🌐 الوصول إلى الشبكة (2)
references/setup.md:11 references/setup.md:13
📁 الوصول إلى نظام الملفات (15)
references/setup.md:11 references/setup.md:12 references/setup.md:14 references/setup.md:42 references/setup.md:44 references/setup.md:11 references/setup.md:12 references/setup.md:14 references/setup.md:42 references/setup.md:44 references/setup.md:44 references/sops-notes.md:7 references/sops-notes.md:7 SKILL.md:21 SKILL.md:21
🔑 متغيرات البيئة (3)
references/sops-notes.md:31 SKILL.md:9 SKILL.md:69
دقّقه: codex
شارك واستشهد بهذا التقرير

شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.

فتح التقرير المرتبط بالإصدار
تقييم الأمان

نسخ رابط التقرير

https://skillstore.io/skills/jssblck-using-sops/audits/1?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

شارة Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/jssblck-using-sops/security.svg)](https://skillstore.io/skills/jssblck-using-sops?utm_source=security_passport_badge)

شارة HTML

<a href="https://skillstore.io/skills/jssblck-using-sops?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/jssblck-using-sops/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

بطاقة قابلة للتضمين

<iframe src="https://skillstore.io/embed/skills/jssblck-using-sops.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
الاستشهادات الأكاديمية (APA · BibTeX · CFF)

اقتباس APA

jssblck. (2026). using-sops security audit report (audit version 1) [Author version unspecified]. Skillstore. https://skillstore.io/skills/jssblck-using-sops/audits/1

اقتباس BibTeX

@techreport{jssblck-jssblck-using-sops-2026, author = {jssblck}, title = {using-sops security audit report (audit version 1)}, institution = {Skillstore}, year = {2026}, number = {1}, url = {https://skillstore.io/skills/jssblck-using-sops/audits/1}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "using-sops security audit report (audit version 1)" version: "unspecified" type: report authors: - name: "jssblck" date-released: "2026-08-23" url: "https://skillstore.io/skills/jssblck-using-sops/audits/1" identifiers: - type: other value: "skillstore:jssblck-using-sops:audit:1" description: "Skillstore immutable audit report identifier"

تقييم Skillstore

سبب هذا التقييم موثوقية الأدلة: منخفض
41
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
65
المجتمع
83
الامتثال للمواصفات

ما الذي يمكنك بناؤه

Update Development Configuration

Inspect or change an encrypted development variable through the repository wrapper.

Configure Deployment Secrets

Prepare production decryption and service startup while keeping the key outside application files.

Rotate SOPS Recipients

Replace a lost or compromised age recipient and re-encrypt affected secret files.

جرّب هذه الموجّهات

Inspect One Development Variable 
Use the repository secrets wrapper to retrieve [VARIABLE] from development. Explain the command first and avoid displaying unrelated values.
Add a Development Secret 
Add [VARIABLE] to the development secrets and environment schema. Confirm before changing files and report any environment you cannot decrypt.
Run a Command With Secrets 
Run [COMMAND] with development secrets through the repository wrapper. Verify the command scope and do not print decrypted values.
Plan Recipient Rotation 
Review the SOPS recipients for [PROJECT]. Propose a rotation plan for [COMPROMISED_RECIPIENT], including affected files, approvals, re-encryption, and credential replacement.

أفضل الممارسات

  • Use the repository wrapper instead of calling SOPS directly.
  • Request approval before revealing, changing, or executing with any secret.
  • Rotate both recipients and decrypted values after a private key leak.

تجنب

  • Do not print complete decrypted files when one variable is sufficient.
  • Do not place personal or production private keys in tracked files, logs, or cloud agent environments.
  • Do not leave production elevation active after the approved operation.

الأسئلة المتكررة

What repository layout does this skill expect?
It expects .sops.yaml, encrypted secrets files, and a pnpm secrets wrapper such as tools/secrets.ts.
Can it work without an age private key?
It can create files for configured public recipients, but decryption and editing require an authorized private key.
Does it call SOPS directly?
It instructs agents to use the repository wrapper when one exists.
How are production secrets protected?
Production uses a project-specific identity and requires checkout elevation. The documented elevation remains active until manually removed.
Can it rotate a compromised recipient?
It guides recipient replacement, SOPS updatekeys, commit review, and rotation of every value exposed by the old key.
Is cloud agent key storage safe?
The documented environment-variable approach is high risk. Use scoped, short-lived credentials in a supported secret store instead.

تفاصيل المطور

المؤلف

jssblck

الترخيص

MIT

مراجعة Skillstore

r1

تنبيه الإصدار

لم يعلن المؤلف عن إصدار.

المستودع

https://github.com/jssblck/agents/tree/4658295e88faed205cc134edf987f7ea4e0c8ea4/skills/using-sops

مرجع

0139ec01bdea5a1eaac3b0e3c90753dbfe65aaa1

حداثة الصيانة

٢٣‏/٨‏/٢٠٢٦

الاستخدام

0 تنزيلات · 0 مشاهدات

بنية الملفات

📁 agents/

📄 openai.yaml

📁 references/

📄 setup.md

📄 sops-notes.md

📄 SKILL.md

المزيد من jssblck

عرض الكل

مهارات ذات صلة

عرض الكل