메뉴
Use when working with Vault, SOPS, secret scanning, or managing credentials safely
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
Use before any DevOps build, change, or new feature — refine requirements through dialogue before touching infrastructure or code
Use when working with Docker — building images, writing Dockerfiles, debugging container issues
Use to execute a written implementation plan via subagents with review checkpoints
Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
Use when working with Kubernetes or Helm — authoring, reviewing, hardening, or debugging manifests, Deployments, Services, Ingress, RBAC, NetworkPolicy, or cluster operations
Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
| name | secrets-management |
| description | Use when working with Vault, SOPS, secret scanning, or managing credentials safely |
SECRETS NEVER GO IN CODE, CONFIGS, OR GIT HISTORY
# gitleaks — scan for leaked secrets
gitleaks detect --source . --verbose
# truffleHog — scan git history
trufflehog git file://. --only-verified
# Check git history for a specific pattern
git log -p | grep -i "password\|secret\|api_key\|token"
If you find a secret in git history:
git filter-repo to remove it from history.gitleaks.toml to prevent recurrence# Encrypt a file
sops --encrypt secrets.yaml > secrets.enc.yaml
# Decrypt
sops --decrypt secrets.enc.yaml
# Edit encrypted file in-place
sops secrets.enc.yaml
# Authenticate
vault login
# Read a secret
vault kv get secret/myapp/database
# Write a secret
vault kv put secret/myapp/database password=mysecret
# List secrets
vault kv list secret/myapp
# Create a secret
kubectl create secret generic db-secret \
--from-literal=password=mysecret
# Use in a pod (env var)
env:
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: db-secret
key: password
| Mistake | Prevention |
|---|---|
| Secret in environment variable in CI YAML | Use CI secret store — never write value directly |
Secret in Docker ENV instruction | Use secret mounts (--secret) or inject at runtime |
.env file committed to git | Add .env* to .gitignore before first commit |
| Credentials in Terraform state | Use encrypted remote state |
tooling/security/vault/ — Vault policies, auth configstooling/security/sops/ — .sops.yaml templatestooling/security/scanning/ — gitleaks, truffleHog configs