菜单
Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
| name | secret-handling |
| description | Handle API keys, tokens and passwords safely — store them in the vault, reference by name, never in chat, repo, memory, or code. |
| category | Security |
| tags | secrets, vault, security, credentials |
Any time an API key, token, or password appears or is needed.
Secrets go in the encrypted vault, immediately, referenced by name — never pasted into chat, committed to a repo, written into a memory, or hardcoded.
secret_set("SOME_API_KEY", <value>) → encrypted at rest, never returned.token_env="SOME_API_KEY"),
and the server injects the value at call time. The model never sees it.secret_list (names only) · secret_delete(name).Treat it as compromised: rotate it at the source, update the vault with the new value, and remove the exposed copy. A leaked encryption key means re-encrypting the vault — rotate carefully and re-store the affected secrets.
Write a blameless incident postmortem — timeline, impact, root cause, and concrete follow-ups, focused on systems not people.
Write clear, conventional git commit messages — type(scope): summary, imperative mood, a body that explains the why.
Build small, secure container images — pinned base, non-root user, multi-stage builds, no secrets in layers, minimal attack surface.
Control and query Home Assistant through the connector's call_service tool — REST API patterns, common domains, how to find entities before acting.
Design predictable REST APIs — noun resources, correct status codes, pagination, consistent errors, and versioning.
Diagnose slow queries and add the right indexes — read the query plan, index for filters/joins/sorts, avoid over-indexing.