メニュー
Use when working with Vault, SOPS, secret scanning, or managing credentials safely
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
SOC 職業分類に基づく
Use before any DevOps build, change, or new feature — refine requirements through dialogue before touching infrastructure or code
Use when working with Docker — building images, writing Dockerfiles, debugging container issues
Use to execute a written implementation plan via subagents with review checkpoints
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
Use when working with Kubernetes or Helm — authoring, reviewing, hardening, or debugging manifests, Deployments, Services, Ingress, RBAC, NetworkPolicy, or cluster operations
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
| name | secrets-management |
| description | Use when working with Vault, SOPS, secret scanning, or managing credentials safely |
SECRETS NEVER GO IN CODE, CONFIGS, OR GIT HISTORY
# gitleaks — scan for leaked secrets
gitleaks detect --source . --verbose
# truffleHog — scan git history
trufflehog git file://. --only-verified
# Check git history for a specific pattern
git log -p | grep -i "password\|secret\|api_key\|token"
If you find a secret in git history:
git filter-repo to remove it from history.gitleaks.toml to prevent recurrence# Encrypt a file
sops --encrypt secrets.yaml > secrets.enc.yaml
# Decrypt
sops --decrypt secrets.enc.yaml
# Edit encrypted file in-place
sops secrets.enc.yaml
# Authenticate
vault login
# Read a secret
vault kv get secret/myapp/database
# Write a secret
vault kv put secret/myapp/database password=mysecret
# List secrets
vault kv list secret/myapp
# Create a secret
kubectl create secret generic db-secret \
--from-literal=password=mysecret
# Use in a pod (env var)
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-secret
key: password
| Mistake | Prevention |
|---|---|
| Secret in environment variable in CI YAML | Use CI secret store — never write value directly |
Secret in Docker ENV instruction | Use secret mounts (--secret) or inject at runtime |
.env file committed to git | Add .env* to .gitignore before first commit |
| Credentials in Terraform state | Use encrypted remote state |
tooling/security/vault/ — Vault policies, auth configstooling/security/sops/ — .sops.yaml templatestooling/security/scanning/ — gitleaks, truffleHog configs