Skills aws-secrets-rotation

📦

aws-secrets-rotation

Name: aws-secrets-rotation
Author: sickn33

Content revision r2 Critical ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Automate AWS Secrets Rotation Safely

Manual credential rotation creates outages and compliance gaps. This skill provides AWS Secrets Manager examples for rotation functions, monitoring, audits, and application retrieval.

Supports: Claude Codex Code(CC)

⚠️ 38 Poor

Do not auto-install this skill.

The canonical policy requires operator review before any installation action.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "aws-secrets-rotation" from https://skillstore.io/skills/sickn33-aws-secrets-rotation.md and its manifest at https://skillstore.io/api/skills/sickn33-aws-secrets-rotation/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/sickn33-aws-secrets-rotation.md Signed manifest GET /api/skills/sickn33-aws-secrets-rotation/manifest Signed lockfile GET /api/skills/sickn33-aws-secrets-rotation/lockfile

Test it

Using "aws-secrets-rotation". Audit production secrets for a 90-day rotation policy.

Expected outcome:

Scope: Production Secrets Manager entries in the approved regions.
Finding: Rotation is disabled for two secrets and overdue for three secrets.
Action: Assign owners, enable tested rotation, and preserve audit evidence.

Using "aws-secrets-rotation". Plan rotation for an RDS MySQL credential.

Expected outcome:

The plan separates create, set, test, and finish stages. It validates the pending password before promotion and defines alarms and rollback.

Using "aws-secrets-rotation". Prepare an emergency API key rotation runbook.

Expected outcome:

Confirm the incident scope and authorize rotation.
Create and validate the replacement key before revoking the old key.
Monitor dependent services and record completion evidence.

Security Audit

Critical

v5 • 7/23/2026 Open versioned report

Most external-command alerts are Markdown fence detections or bounded examples, while the documented AWS and Stripe operations are intentional. However, the skill uploads a default SSH private key, writes a decrypted key to disk, places an API key in a URL, and contains rotation-stage defects that can activate untested credentials. These issues require remediation before publication.

Files scanned

471

Lines analyzed

Review items

False positives ignored

Confirmed security concerns (5)

Critical

SKILL.md:61

SSH directory access

--secret-binary fileb://~/.ssh/id_rsa

The command explicitly reads ~/.ssh/id_rsa and uploads its bytes. An existing SSH private key is highly sensitive and should not be used as generic example input.

Critical

SKILL.md:61

SSH private key file

--secret-binary fileb://~/.ssh/id_rsa

The referenced file is the conventional default SSH private key. Uploading it expands exposure and can compromise every system that trusts the corresponding public key.

High

SKILL.md:82

Certificate/key files

base64 -d > private-key.pem

The example decodes a retrieved private key into private-key.pem without setting restrictive permissions or cleanup. This can leave sensitive key material exposed on disk.

High

SKILL.md:124-166

RDS Rotation Promotes an Uninstalled Password

Every step reads the default AWSCURRENT value, so setSecret and testSecret never use AWSPENDING. finishSecret can promote a password that was not installed or tested.

The code fetches the secret without ClientRequestToken or VersionStage, then uses that same value for set and test before promoting the token.

High

SKILL.md:191-232

API Rotation Tests the Old Key Before Revocation

Later invocations reload AWSCURRENT, so testSecret validates the old key. finishSecret revokes that key before promotion, risking an outage and untested key activation.

The new key exists only in the createSecret invocation, while later steps fetch the default current version and never request AWSPENDING.

Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

SKILL.md:224

Hardcoded URL

f'https://api.stripe.com/v1/api_keys/{old_key}',

The request interpolates the old API key into the URL path. URLs are commonly logged by clients, proxies, and servers, creating credential-exposure risk.

High

SKILL.md:61

Hidden file in home directory

--secret-binary fileb://~/.ssh/id_rsa

The command reads the user's default SSH private key from a hidden home directory and uploads it to Secrets Manager. This can expose a real login credential.

High

SKILL.md:61

Hidden file access

--secret-binary fileb://~/.ssh/id_rsa

The example explicitly accesses ~/.ssh/id_rsa rather than a placeholder test file. Reading this hidden file crosses a sensitive local-data boundary.

High

SKILL.md:224

Generic API/secret keys

f'https://api.stripe.com/v1/api_keys/{old_key}',

The old credential is placed directly in a URL path, where request logging can disclose it. This is unsafe secret handling even though the domain is Stripe.

Medium

SKILL.md:223

Python HTTP libraries

requests.delete(

The DELETE request revokes an external API key and can disrupt dependent applications. It is an intentional destructive network operation.

Low

SKILL.md:196

Python HTTP libraries

response = requests.post(

The example makes an authenticated POST to create a third-party credential. This is an intentional but security-sensitive external account change.

Low

SKILL.md:213

Python HTTP libraries

response = requests.get(

The example sends a stored API key in an authenticated request to Stripe. The official HTTPS destination limits exposure, but outbound secret use is real.

Risk Factors

⚙️ External commands (27)

🌐 Network access (9)

SKILL.md:196 SKILL.md:213 SKILL.md:223 SKILL.md:197 SKILL.md:214 SKILL.md:224 SKILL.md:463 SKILL.md:464 SKILL.md:465

📁 Filesystem access (2)

SKILL.md:61 SKILL.md:61

🔑 Env variables (9)

SKILL.md:54 SKILL.md:181 SKILL.md:197 SKILL.md:198 SKILL.md:203 SKILL.md:215 SKILL.md:222 SKILL.md:224 SKILL.md:225

Detected Patterns

SSH directory accessSSH private key file

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Copy report link

https://skillstore.io/skills/sickn33-aws-secrets-rotation/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-aws-secrets-rotation/security.svg)](https://skillstore.io/skills/sickn33-aws-secrets-rotation?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-aws-secrets-rotation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-aws-secrets-rotation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-aws-secrets-rotation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). aws-secrets-rotation security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-aws-secrets-rotation/audits/5

BibTeX citation

@techreport{sickn33-sickn33-aws-secrets-rotation-2026,
  author = {sickn33},
  title = {aws-secrets-rotation security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-aws-secrets-rotation/audits/5},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "aws-secrets-rotation security audit report (audit version 5)"
version: "unspecified"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/sickn33-aws-secrets-rotation/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-aws-secrets-rotation:audit:5"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

Architecture

Maintainability

Content

Community

Spec Compliance

What You Can Build

Plan RDS Credential Rotation

Create a reviewed rotation design for database credentials, including schedules, Lambda steps, testing, monitoring, and rollback.

Audit Rotation Compliance

Assess Secrets Manager entries for enabled rotation, stale credentials, missing dates, and alert coverage.

Integrate Managed Secrets

Adapt Python or Node.js applications to retrieve credentials from Secrets Manager without storing them in source code.

Try These Prompts

Explain a Safe Rotation Plan

Explain how to rotate [secret type] in AWS account [environment]. Provide prerequisites, permissions, validation steps, and rollback. Do not execute commands.

Design RDS Rotation

Design rotation for [RDS engine] using Secrets Manager and Lambda. Include version stages, least-privilege IAM, testing, monitoring, and failure recovery.

Build a Compliance Audit

Create a read-only audit approach for Secrets Manager in [regions]. Report disabled rotation, overdue secrets, pagination, errors, and evidence requirements.

Review a Custom Provider Rotation

Review this [provider] key-rotation design for idempotency, pending-version handling, credential exposure, revocation order, retries, timeouts, and rollback. Identify blocking defects.

Best Practices

Use AWS managed rotation templates when available, with least-privilege IAM and encryption controls.
Test AWSPENDING credentials before promotion, and preserve a tested rollback path.
Monitor every rotation step and audit schedules across all configured regions and pages.

Avoid

Do not upload an existing personal SSH key as an example secret.
Do not place secret values in URLs, logs, command history, or unprotected files.
Do not revoke current credentials before replacements are installed, tested, and recoverable.

Frequently Asked Questions

Does this skill execute AWS changes automatically?

No. It provides examples and plans. Users must review commands, permissions, account identifiers, and production safeguards before execution.

Which secret types are covered?

It covers RDS credentials, API keys, OAuth tokens, SSH keys, and custom credentials stored in AWS Secrets Manager.

Are the Lambda examples production ready?

No. The audit identifies pending-version defects. Add stage validation, idempotency, robust errors, tests, monitoring, and rollback before deployment.

Can it audit rotation compliance?

Yes. It includes shell and Python examples for rotation status, age, enabled state, and basic compliance reporting.

Does it include least-privilege IAM policies?

No. You must design IAM policies for specific secrets, functions, databases, keys, regions, and monitoring resources.

How should private keys be handled?

Use generated test material in examples. Avoid disk storage, enforce restrictive permissions, limit access, encrypt backups, and define secure cleanup.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

Version notice

The author did not declare a version.

Repository

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/security/aws-secrets-rotation

Ref

86d877f219e2131f05dd5b37c5e329c71c7b8ec4

Maintenance freshness

7/26/2026

Usage

6 downloads · 94 views

File structure

📄 SKILL.md