Menu
OpenBao/Vault credential seeding and management scripts
Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.
Basé sur la classification professionnelle SOC
Execute roadmap items iteratively with policy-aware vendor routing and learning feedback
Orchestrate the full plan-review-implement-validate-PR lifecycle with multi-vendor review convergence
Comprehensive project health diagnostic — collects signals from CI tools, existing reports, deferred issues, and code markers into a prioritized finding report
Generate changelog entries and suggest semantic version bumps from git history
HTTP fallback bridge for coordinator when MCP transport is unavailable
Readiness gate for sync-point operations — inspect validation, rework, and active-agent state before merge
| name | bao-vault |
| description | OpenBao/Vault credential seeding and management scripts |
| category | Infrastructure |
| tags | ["bao","vault","credentials","infrastructure"] |
| user_invocable | false |
Non-user-invocable infrastructure skill for OpenBao/Vault credential seeding and management.
Seeds OpenBao with agent API keys and secrets from agents.yaml configuration. Reads any string-valued key in .secrets.yaml and writes it under the configured KV mount, so adding new credential names (e.g. LANGFUSE_PUBLIC_KEY) requires no code change — just add the key to .secrets.yaml and re-run.
Usage:
python3 "<skill-base-dir>/scripts/bao_seed.py" [options]
Environment variables:
BAO_ADDR — OpenBao server addressBAO_TOKEN — Root or privileged token for seedingBAO_SECRETS_FILE — secrets YAML path (defaults to .secrets.yaml in the current project)AGENTS_YAML — agent configuration path (defaults to agents.yaml in the current project)Both inputs can also be supplied with --secrets-path and --agents-path.
The skill does not assume that the consumer contains an agent-coordinator/
checkout.
Exit codes: 0 = seeded successfully, 1 = error
Resolves LANGFUSE_PUBLIC_KEY, LANGFUSE_SECRET_KEY, and LANGFUSE_HOST from OpenBao (preferring values already in the environment), computes LANGFUSE_BASIC_AUTH = base64(public:secret), and emits four export lines on stdout. Designed to be sourced via eval:
eval "$("<skill-base-dir>/scripts/langfuse_env.sh")"
Falls back silently when BAO_ADDR is unset or the keys are already populated, so it is safe to put in shell init or scripts.
Authentication: prefers BAO_TOKEN if set, otherwise uses AppRole login via BAO_ROLE_ID + BAO_SECRET_ID (matches bao_seed.py).
Consumed by:
<skill-base-dir>/../langfuse/scripts/install-mcp.sh — computes the literal Basic-auth token written into Codex / Gemini user-global config files.<skill-base-dir>/../langfuse/scripts/run_stop_hook.sh — populates the env for the Claude Code Stop-hook tracer.