메뉴
기본적으로 소스를 먼저 확인하는 Prompt가 선택됩니다. 직접 명령으로 전환하거나 로컬 사본을 다운로드할 수도 있습니다.
설치 여부를 결정하기 전에 SKILL.md와 SkillsMP에 표시된 보조 파일을 읽어 보세요.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
직접 명령은 검토 Prompt를 거치지 않습니다. 실행하기 전에 소스를 확인하세요.
npx skills add https://github.com/thiagofernandes1987-create/APEX --skill env-secrets-manager명령은 한 줄로 유지됩니다. 복사하기 전에 가로로 스크롤해 전체 내용을 확인하세요.
로컬 사본을 원하시나요? SkillsMP에서 현재 제공할 수 있는 파일을 다운로드하세요.
Token-aware reasoning workflow with real tools: picks an operating mode to control cost, runs a structured pipeline (decompose → validate → verify → snapshot), and gives Claude Program-of-Thought, RK4/Euler, a code gate, and a safe skill router. Use when: multi-step or high-stakes tasks, real math, precise computation, audits, or the user mentions APEX, PoT, pipeline, or scientific mode.
**v00.33.0**: Ingested from antigravity-awesome-skills community repo
run multiple local CLI agents in parallel (separate tmux sessions)
SOC 직업 분류 기준
SKILL.md 표시 중
| name | env-secrets-manager |
| description | Before pushing commits that touched env/config files |
| executor | HYBRID |
| skill_id | engineering.cs-engineering.env-secrets-manager |
| status | ADOPTED |
| security | {"level":"high","pii":false,"approval_required":true} |
| anchors | ["engineering"] |
| tier | 2 |
| input_schema | [{"name":"code_or_task","type":"string","description":"Code snippet, script, or task description to process","required":true}] |
| output_schema | [{"name":"result","type":"string","description":"Primary output from env secrets manager"}] |
Tier: POWERFUL Category: Engineering Domain: Security / DevOps / Configuration Management
Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness.
.env and .env.example lifecycle guidance# Scan a repository for likely secret leaks
python3 scripts/env_auditor.py /path/to/repo
# JSON output for CI pipelines
python3 scripts/env_auditor.py /path/to/repo --json
scripts/env_auditor.py on the repository root.critical and high findings first..env.example and .gitignore as needed.references/validation-detection-rotation.mdreferences/secret-patterns.md.env.exampleProduction applications should never read secrets from .env files or environment variables baked into container images. Use a dedicated secret store instead.
| Provider | Best For | Key Feature |
|---|---|---|
| HashiCorp Vault | Multi-cloud / hybrid | Dynamic secrets, policy engine, pluggable backends |
| AWS Secrets Manager | AWS-native workloads | Native Lambda/ECS/EKS integration, automatic RDS rotation |
| Azure Key Vault | Azure-native workloads | Managed HSM, Azure AD RBAC, certificate management |
| GCP Secret Manager | GCP-native workloads | IAM-based access, automatic replication, versioning |
Secret objects without hardcoding.Cross-reference: See
engineering/secrets-vault-managerfor production vault infrastructure patterns, HA deployment, and disaster recovery procedures.
Stale secrets are a liability. Rotation ensures that even if a credential leaks, its useful lifetime is bounded.
scripts/env_auditor.py to flag secrets with no recorded rotation date.When a secret is confirmed leaked:
Secrets in CI/CD pipelines require careful handling to avoid exposure in logs, artifacts, or pull request contexts.
${{ secrets.SECRET_NAME }}.aws-actions/configure-aws-credentials with role-to-assume) over long-lived access keys.echo or toJSON() on secret values.masked and protected flags enabled.secrets:vault) for dynamic secret injection without storing values in GitLab.production, staging) to enforce least privilege.Catching secrets before they reach version control is the most cost-effective defense. Two leading tools cover this space.
# .gitleaks.toml — minimal configuration
[extend]
useDefault = true
[[rules]]
id = "custom-internal-token"
description = "Internal service token pattern"
regex = '''INTERNAL_TOKEN_[A-Za-z0-9]{32}'''
secretGroup = 0
brew install gitleaks or download from GitHub releases.gitleaks git --pre-commit --stagedgitleaks detect --source . --report-path gitleaks-report.json.gitleaksignore (one fingerprint per line).# Generate baseline
detect-secrets scan --all-files > .secrets.baseline
# Pre-commit hook (via pre-commit framework)
# .pre-commit-config.yaml
repos:
- repo: https://github.com/Yelp/detect-secrets
rev: v1.5.0
hooks:
- id: detect-secrets
args: ['--baseline', '.secrets.baseline']
detect-secrets audit .secrets.baseline interactively marks true/false positives..gitleaksignore or .secrets.baseline in version control so the whole team shares exclusions.Knowing who accessed which secret and when is critical for incident investigation and compliance.
| Provider | Service | What It Captures |
|---|---|---|
| AWS | CloudTrail | Every GetSecretValue, DescribeSecret, RotateSecret API call |
| Azure | Activity Log + Diagnostic Logs | Key Vault access events, including caller identity and IP |
| GCP | Cloud Audit Logs | Data access logs for Secret Manager with principal and timestamp |
| Vault | Audit Backend | Full request/response logging (file, syslog, or socket backend) |
This skill covers env hygiene and secret detection. For deeper coverage of related domains, see:
| Skill | Path | Relationship |
|---|---|---|
| Secrets Vault Manager | engineering/secrets-vault-manager | Production vault infrastructure, HA deployment, DR |
| Senior SecOps | engineering/senior-secops | Security operations perspective, incident response |
| CI/CD Pipeline Builder | engineering/ci-cd-pipeline-builder | Pipeline architecture, secret injection patterns |
| Infrastructure as Code | engineering/infrastructure-as-code | Terraform/Pulumi secret backend configuration |
| Container Orchestration | engineering/container-orchestration | Kubernetes secret mounting, sealed secrets |
Implement — Env & Secrets Manager
If this skill fails to produce the expected output: (1) verify input completeness, (2) retry with more specific context, (3) fall back to the parent workflow without this skill.