Menu
OpenBao/Vault credential seeding and management scripts
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Execute roadmap items iteratively with policy-aware vendor routing and learning feedback
Orchestrate the full plan-review-implement-validate-PR lifecycle with multi-vendor review convergence
Comprehensive project health diagnostic — collects signals from CI tools, existing reports, deferred issues, and code markers into a prioritized finding report
Generate changelog entries and suggest semantic version bumps from git history
HTTP fallback bridge for coordinator when MCP transport is unavailable
Readiness gate for sync-point operations — inspect validation, rework, and active-agent state before merge
| name | bao-vault |
| description | OpenBao/Vault credential seeding and management scripts |
| category | Infrastructure |
| tags | ["bao","vault","credentials","infrastructure"] |
| user_invocable | false |
Non-user-invocable infrastructure skill for OpenBao/Vault credential seeding and management.
Seeds OpenBao with agent API keys and secrets from agents.yaml configuration. Reads any string-valued key in .secrets.yaml and writes it under the configured KV mount, so adding new credential names (e.g. LANGFUSE_PUBLIC_KEY) requires no code change — just add the key to .secrets.yaml and re-run.
Usage:
python3 "<skill-base-dir>/scripts/bao_seed.py" [options]
Environment variables:
BAO_ADDR — OpenBao server addressBAO_TOKEN — Root or privileged token for seedingBAO_SECRETS_FILE — secrets YAML path (defaults to .secrets.yaml in the current project)AGENTS_YAML — agent configuration path (defaults to agents.yaml in the current project)Both inputs can also be supplied with --secrets-path and --agents-path.
The skill does not assume that the consumer contains an agent-coordinator/
checkout.
Exit codes: 0 = seeded successfully, 1 = error
Resolves LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, and LANGFUSE_HOST from OpenBao (preferring values already in the environment), computes LANGFUSE_BASIC_AUTH = base64(public:secret), and emits four export lines on stdout. Designed to be sourced via eval:
eval "$("<skill-base-dir>/scripts/langfuse_env.sh")"
Falls back silently when BAO_ADDR is unset or the keys are already populated, so it is safe to put in shell init or scripts.
Authentication: prefers BAO_TOKEN if set, otherwise uses AppRole login via BAO_ROLE_ID + BAO_SECRET_ID (matches bao_seed.py).
Consumed by:
<skill-base-dir>/../langfuse/scripts/install-mcp.sh — computes the literal Basic-auth token written into Codex / Gemini user-global config files.<skill-base-dir>/../langfuse/scripts/run_stop_hook.sh — populates the env for the Claude Code Stop-hook tracer.