Menu
Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Write a blameless incident postmortem — timeline, impact, root cause, and concrete follow-ups, focused on systems not people.
Write clear, conventional git commit messages — type(scope): summary, imperative mood, a body that explains the why.
Build small, secure container images — pinned base, non-root user, multi-stage builds, no secrets in layers, minimal attack surface.
Control and query Home Assistant through the connector's call_service tool — REST API patterns, common domains, how to find entities before acting.
Design predictable REST APIs — noun resources, correct status codes, pagination, consistent errors, and versioning.
Diagnose slow queries and add the right indexes — read the query plan, index for filters/joins/sorts, avoid over-indexing.
| name | secret-handling |
| description | Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code. |
| category | Security |
| tags | secrets, vault, security, credentials |
Any time an API key, token, or password appears or is needed.
Secrets go in the encrypted vault, immediately, referenced by name — never pasted into chat, committed to a repo, written into a memory, or hardcoded.
secret_set("SOME_API_KEY", <value>) → encrypted at rest, never returned.token_env="SOME_API_KEY"),
and the server injects the value at call time. The model never sees it.secret_list (names only) · secret_delete(name).Treat it as compromised: rotate it at the source, update the vault with the new value, and remove the exposed copy. A leaked encryption key means re-encrypting the vault — rotate carefully and re-store the affected secrets.