secrets-management
Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.
Source facts
- Repository
- aiming-lab/MetaClaw
- Last source activity
- March 10, 2026 at 18:04
- Detected SKILL.md language
- English
- Stars
- 3,467
- Forks
- 455
Install options
The review-first prompt is selected by default. You can switch to a direct command or download a local copy.
Review the source files
Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.
Showing SKILL.md
SKILL.md
Source instructions · Read-only preview- name
- secrets-management
- description
- Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.
- category
- security
# Secrets Management
**Rules:**
1. **Never** hardcode secrets in source files, configs committed to git, or logs.
2. Use environment variables for local development (`python-dotenv`).
3. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
4. Add `.env` and `*.pem` to `.gitignore` before the first commit.
5. Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).
**Scanning:** Use `ggshield`, `truffleHog`, or `git-secrets` in CI to block secret commits.
**Anti-patterns:**
- `os.environ.get('KEY', 'hardcoded_default')` in production code.
- Logging full request/response bodies that may contain tokens.
View on GitHub