Skills azure-keyvault-secrets-ts
📦

azure-keyvault-secrets-ts

Content revision r2 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Manage Azure Key Vault Secrets in TypeScript

Applications need consistent patterns for protecting secrets and cryptographic keys. This skill provides practical TypeScript guidance for Azure Key Vault operations.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "azure-keyvault-secrets-ts" from https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts.md and its manifest at https://skillstore.io/api/skills/sickn33-azure-keyvault-secrets-ts/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Test it

Using "azure-keyvault-secrets-ts". Retrieve the latest database password without exposing it.

Expected outcome:

A TypeScript workflow authenticates with managed credentials, retrieves the named secret, and reports success without logging its value.

Using "azure-keyvault-secrets-ts". Create a rotation policy for a production signing key.

Expected outcome:

  • Rotate the key 30 days before expiration.
  • Expire each key version after 90 days.
  • Grant only required signing and rotation permissions.

Using "azure-keyvault-secrets-ts". Handle a missing secret safely.

Expected outcome:

The operation distinguishes a missing secret from other failures, returns a clear status, and rethrows unexpected errors.

Security Audit

High Risk
v5 • 7/23/2026 Open versioned report

All 44 static findings are false positives caused by Markdown fences, TypeScript template literals, expected Azure endpoints, and non-sensitive metadata access. However, two examples print retrieved secret or decrypted plaintext values, which can expose sensitive data through application logs.

1
Files scanned
280
Lines analyzed
0
Review items
0
False positives ignored

Confirmed security concerns (1)

High
Sensitive Values Written to Logs
The examples print a retrieved secret value and decrypted plaintext, which can persist confidential data in terminals or centralized logs.
Both calls directly pass sensitive plaintext values to console.log, so the disclosure path is explicit.
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-azure-keyvault-secrets-ts/security.svg)](https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-azure-keyvault-secrets-ts/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/sickn33-azure-keyvault-secrets-ts.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

sickn33. (2026). azure-keyvault-secrets-ts security audit report (audit version 5) [Author version unspecified]. Skillstore. https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts/audits/5

BibTeX citation

@techreport{sickn33-sickn33-azure-keyvault-secrets-ts-2026, author = {sickn33}, title = {azure-keyvault-secrets-ts security audit report (audit version 5)}, institution = {Skillstore}, year = {2026}, number = {5}, url = {https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts/audits/5}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "azure-keyvault-secrets-ts security audit report (audit version 5)" version: "unspecified" type: report authors: - name: "sickn33" date-released: "2026-07-23" url: "https://skillstore.io/skills/sickn33-azure-keyvault-secrets-ts/audits/5" identifiers: - type: other value: "skillstore:sickn33-azure-keyvault-secrets-ts:audit:5" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Add Application Secrets

Create a TypeScript service that stores and retrieves configuration values through Azure Key Vault.

Automate Key Rotation

Define key expiration and rotation policies for managed production encryption keys.

Plan Recovery Operations

Implement backup, restore, soft-delete, purge, and recovery workflows for protected resources.

Try These Prompts

Retrieve One Secret
Show a minimal TypeScript example that authenticates with DefaultAzureCredential and retrieves {{secret_name}} from Azure Key Vault. Do not print the secret value.
Manage Secret Lifecycle
Create a TypeScript workflow for setting, versioning, listing, deleting, and recovering {{secret_name}}. Include expiration, tags, and safe error handling.
Configure Key Rotation
Design an Azure Key Vault key rotation policy for {{key_name}} with {{rotation_days}} days before expiry. Explain required permissions and operational checks.
Build Cryptographic Workflow
Develop a TypeScript design using Azure Key Vault for encryption, decryption, signing, verification, key wrapping, backup, and recovery. Apply least-privilege access.

Best Practices

  • Use managed identity or DefaultAzureCredential instead of embedded credentials.
  • Grant only required secret and key operations to each workload.
  • Set expiration, rotation, backup, recovery, and audit policies before production deployment.

Avoid

  • Do not log secret values, decrypted plaintext, or unwrapped key material.
  • Do not purge deleted secrets or keys without explicit recovery approval.
  • Do not use broad vault permissions when a workload needs limited operations.

Frequently Asked Questions

Which runtime does this skill support?
The examples target Node.js with TypeScript or JavaScript. Azure Key Vault SDK operations shown here do not support browsers.
How does authentication work?
DefaultAzureCredential selects supported local or managed Azure credentials. The active identity still needs suitable vault permissions.
Can it manage both secrets and keys?
Yes. It covers secret lifecycle operations, key lifecycle operations, and cryptographic methods using Azure Key Vault SDK clients.
Does it configure Azure roles automatically?
No. You must configure Azure roles, access policies, vault networking, and identities outside these examples.
Can deleted values be recovered?
Yes, when soft-delete and retention settings permit recovery. Purged values cannot be recovered through the demonstrated methods.
Is the guidance production ready?
It provides implementation patterns, but each workflow requires security review, testing, monitoring, and environment-specific configuration before production use.

Developer Details

Author

sickn33

License

MIT

Skillstore revision

r2

Version notice

The author did not declare a version.

Ref

f9e2c34b4f19c7f3e6b0a1e93227b5f77cc12526

Maintenance freshness

7/26/2026

Usage

6 downloads · 140 views

File structure

📄 SKILL.md