Menu
Use when working with Vault, SOPS, secret scanning, or managing credentials safely
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Use before any DevOps build, change, or new feature — refine requirements through dialogue before touching infrastructure or code
Use when working with Docker — building images, writing Dockerfiles, debugging container issues
Use to execute a written implementation plan via subagents with review checkpoints
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
Use when working with Kubernetes or Helm — authoring, reviewing, hardening, or debugging manifests, Deployments, Services, Ingress, RBAC, NetworkPolicy, or cluster operations
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
| name | secrets-management |
| description | Use when working with Vault, SOPS, secret scanning, or managing credentials safely |
SECRETS NEVER GO IN CODE, CONFIGS, OR GIT HISTORY
# gitleaks — scan for leaked secrets
gitleaks detect --source . --verbose
# truffleHog — scan git history
trufflehog git file://. --only-verified
# Check git history for a specific pattern
git log -p | grep -i "password\|secret\|api_key\|token"
If you find a secret in git history:
git filter-repo to remove it from history.gitleaks.toml to prevent recurrence# Encrypt a file
sops --encrypt secrets.yaml > secrets.enc.yaml
# Decrypt
sops --decrypt secrets.enc.yaml
# Edit encrypted file in-place
sops secrets.enc.yaml
# Authenticate
vault login
# Read a secret
vault kv get secret/myapp/database
# Write a secret
vault kv put secret/myapp/database password=mysecret
# List secrets
vault kv list secret/myapp
# Create a secret
kubectl create secret generic db-secret \
--from-literal=password=mysecret
# Use in a pod (env var)
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-secret
key: password
| Mistake | Prevention |
|---|---|
| Secret in environment variable in CI YAML | Use CI secret store — never write value directly |
Secret in Docker ENV instruction | Use secret mounts (--secret) or inject at runtime |
.env file committed to git | Add .env* to .gitignore before first commit |
| Credentials in Terraform state | Use encrypted remote state |
tooling/security/vault/ — Vault policies, auth configstooling/security/sops/ — .sops.yaml templatestooling/security/scanning/ — gitleaks, truffleHog configs