secrets-management
Secure CI/CD secrets across pipelines
CI/CD pipelines often leak secrets through hardcoded values and logs. This skill guides you to store, rotate, and consume secrets safely with popular platforms.
Download the skill ZIP
Upload in Claude
Go to Settings → Capabilities → Skills → Upload skill
Toggle on and start using
Test it
Using "secrets-management". Show a safe way to pull an API key into GitLab CI from Vault.
Expected outcome:
- Use the Vault CLI in the job to fetch the key field
- Export the key to a masked environment variable
- Avoid printing the secret in logs
- Rotate the key and update the Vault entry regularly
Using "secrets-management". How do I set up automatic secret rotation for my database credentials?
Expected outcome:
- Configure AWS Secrets Manager with automatic rotation enabled
- Create a Lambda function that generates a new password
- Update both the database and the secret in the store
- Test the rotation before deploying to production
Using "secrets-management". What are the risks of hardcoding secrets in CI pipelines?
Expected outcome:
- Secrets appear in build logs and artifacts
- Secrets get committed to version control accidentally
- Secrets are exposed to anyone with repository access
- Rotating secrets requires code changes and deployments
Security Audit
SafeDocumentation-only skill providing CI/CD secrets management guidance. Static findings triggered on legitimate tool references (Vault, AWS), environment variable examples, and shell script documentation - all expected content for a secrets management educational resource. No executable code or malicious patterns detected.
Risk Factors
🌐 Network access (6)
⚙️ External commands (40)
Quality Score
What You Can Build
Harden CI secrets
Set up secure secret retrieval for build and deploy stages without hardcoded values.
Define rotation flow
Create a consistent secret rotation process and logging guidance for teams.
Kubernetes secrets sync
Model External Secrets Operator usage for cluster workloads.
Try These Prompts
Explain how to store and use a database password in CI without hardcoding, using one platform from the skill.
Draft GitHub Actions steps that read two secrets from Vault and expose them as environment variables.
Outline steps to create a secret and retrieve it in a CI job, including masking the output.
Design a secret rotation workflow for a database, including update steps and validation checkpoints.
Best Practices
- Use different secrets per environment
- Mask secrets in logs and outputs
- Enable audit logging and rotation
Avoid
- Commit secrets to version control
- Reuse production secrets in test pipelines
- Echo secrets to logs for debugging
Frequently Asked Questions
Which CI platforms are supported?
What are the limits of this skill?
Can it integrate with Vault or AWS Secrets Manager?
Does it access my secrets or send data out?
What if a command in the example fails?
How does this compare to using plain CI secrets?
Developer Details
Author
wshobsonLicense
MIT
Repository
https://github.com/wshobson/agents/tree/main/plugins/cicd-automation/skills/secrets-managementRef
main
File structure
📄 SKILL.md