القائمة
Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Write a blameless incident postmortem — timeline, impact, root cause, and concrete follow-ups, focused on systems not people.
Write clear, conventional git commit messages — type(scope): summary, imperative mood, a body that explains the why.
Build small, secure container images — pinned base, non-root user, multi-stage builds, no secrets in layers, minimal attack surface.
Control and query Home Assistant through the connector's call_service tool — REST API patterns, common domains, how to find entities before acting.
Design predictable REST APIs — noun resources, correct status codes, pagination, consistent errors, and versioning.
Diagnose slow queries and add the right indexes — read the query plan, index for filters/joins/sorts, avoid over-indexing.
| name | secret-handling |
| description | Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code. |
| category | Security |
| tags | secrets, vault, security, credentials |
Any time an API key, token, or password appears or is needed.
Secrets go in the encrypted vault, immediately, referenced by name — never pasted into chat, committed to a repo, written into a memory, or hardcoded.
secret_set("SOME_API_KEY", <value>) → encrypted at rest, never returned.token_env="SOME_API_KEY"),
and the server injects the value at call time. The model never sees it.secret_list (names only) · secret_delete(name).Treat it as compromised: rotate it at the source, update the vault with the new value, and remove the exposed copy. A leaked encryption key means re-encrypting the vault — rotate carefully and re-store the affected secrets.