菜单
Audits Supabase Vault secrets — lists all stored secrets, tests API token validity, checks OAuth token freshness, and reports missing or expired credentials. Use when troubleshooting auth failures, after setup, or for periodic health checks.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Bootstraps a new project directory with base configuration files, MCP servers, API connections, and template skills from OutworkOS. Use when setting up a new project, initializing a workspace, or configuring MCP integrations for a new directory.
Gain-based weekly reflection. Looks backward at what moved forward across all projects, written as narrative prose. Modeled on The Gap and The Gain — measures progress against where you were, not where you wish you were.
Composes, drafts, and sends emails via Gmail. Enforces natural writing style (no em dashes, no AI tells), proper threading, and correct signature handling. Use whenever drafting, replying to, or sending any email.
"Produces a meeting prep briefing for upcoming calendar meetings by researching attendees, email history, past meetings, and company backgrounds. Use when the user asks to prepare for meetings, prep for tomorrow, review upcoming meetings, get ready for a meeting day, or asks 'what meetings do I have'. Also use when the user asks to research a specific meeting or contact before a call."
"Cross-project inbox scan — cleans noise, routes signals to projects, creates Todoist tasks for gaps, and ranks priorities by time block. Replaces /triage, /inbox-zero, and /sitrep."
Generates Spotify playlists using MCP spotify tools. Use when user wants to create a playlist based on mood, genre, similar artists, or any theme. Handles auth, track discovery, playlist creation, and adding tracks.
| name | vault-health |
| description | Audits Supabase Vault secrets — lists all stored secrets, tests API token validity, checks OAuth token freshness, and reports missing or expired credentials. Use when troubleshooting auth failures, after setup, or for periodic health checks. |
| allowed-tools | ["Bash(curl:*)","Bash(*/get-secret.sh:*)","Bash(*/send-pushover.sh:*)","Read","Grep","ToolSearch"] |
Enumerates all secrets in Supabase Vault, compares against the expected registry, and tests every testable API token. Reports a single status table so you know what works, what's broken, and how to fix it.
At the start of each audit, retrieve the user's Supabase project reference for constructing API URLs:
SELECT email FROM user_profiles WHERE user_id = auth.uid()
For Supabase API endpoints that require the project reference (e.g., REST API base URL), retrieve the project ref dynamically:
SUPABASE_TOKEN=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" supabase_access_token)
PROJECT_REF=$(curl -s -H "Authorization: Bearer $SUPABASE_TOKEN" \
https://api.supabase.com/v1/projects | python3 -c "
import json, sys
projects = json.load(sys.stdin)
# Use the first project, or filter by name if multiple
if projects:
print(projects[0]['id'])
")
Use PROJECT_REF to construct Supabase URLs dynamically: https://{PROJECT_REF}.supabase.co/rest/v1/
For the Supabase dashboard, construct URLs as: https://supabase.com/dashboard/project/{PROJECT_REF}/settings/api
$OUTWORKOS_ROOT/scripts/get-secret.sh <label>.ToolSearch to discover Supabase tools at runtime if needed.Enumerate all expected secrets from references/secret-registry.md. For each label, attempt retrieval:
LABEL="fireflies_token" # example — iterate over all 21 labels
VALUE=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" "$LABEL" 2>/dev/null) && echo "FOUND" || echo "MISSING"
Run all 21 retrievals in parallel (separate Bash calls) for speed. Record which labels returned a value and which are missing.
Load the full registry from references/secret-registry.md. For each entry:
Testable? = Yes) or mark as · (exists, not testable).✗ with note "secret not found in Vault".For each testable secret that was found in Step 1, run the corresponding validation call from references/test-patterns.md. Run all tests in parallel (separate Bash calls).
Each test follows this pattern:
TOKEN=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" "<label>")
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" <endpoint with TOKEN>)
if [ "$HTTP_CODE" = "200" ]; then echo "PASS"; else echo "FAIL:$HTTP_CODE"; fi
Important: Never store token values in variables that appear in output. Only capture and display HTTP status codes.
OAuth services (Google, LinkedIn) require a token refresh test, not just a simple API call.
Retrieve google_client_id, google_client_secret, and google_refresh_token. Attempt a token refresh:
CLIENT_ID=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" google_client_id)
CLIENT_SECRET=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" google_client_secret)
REFRESH_TOKEN=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" google_refresh_token)
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-d "client_id=$CLIENT_ID&client_secret=$CLIENT_SECRET&refresh_token=$REFRESH_TOKEN&grant_type=refresh_token" \
https://oauth2.googleapis.com/token)
Retrieve linkedin_access_token and test the userinfo endpoint:
ACCESS_TOKEN=$("$OUTWORKOS_ROOT/scripts/get-secret.sh" linkedin_access_token)
HTTP_CODE=$(curl -s -o /dev/null -w "%{http_code}" \
-H "Authorization: Bearer $ACCESS_TOKEN" \
https://api.linkedin.com/v2/userinfo)
Display a summary table in the terminal:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
VAULT HEALTH — YYYY-MM-DD HH:MM
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Service Secret Status
─────────────────────────────────────────────────────
Google google_client_id · exists (not testable)
Google google_client_secret · exists (not testable)
Google google_refresh_token ✓ OAuth refresh OK
Google google_redirect_uri · exists (not testable)
Google google_token_uri · exists (not testable)
LinkedIn linkedin_client_id · exists (not testable)
LinkedIn linkedin_client_secret · exists (not testable)
LinkedIn linkedin_refresh_token ✓ OAuth refresh OK
LinkedIn linkedin_access_token ✓ API call OK (200)
LinkedIn linkedin_person_urn · exists (not testable)
Fireflies fireflies_token ✓ GraphQL ping OK (200)
Supabase supabase_access_token ✓ list projects OK (200)
— (supabase_service_role_key lives in Keychain, not Vault — excluded)
Netlify netlify_auth_token ✓ user endpoint OK (200)
Anthropic anthropic_api_key ✓ models list OK (200)
Todoist todoist_api_token ✓ sync OK (200)
ElevenLabs elevenlabs_api_key ✓ user endpoint OK (200)
Pushover pushover_user_key · exists (not testable alone)
Pushover pushover_api_token ✓ validate OK (200)
ScrapingDog scrapingdog_api_key ✓ usage endpoint OK (200)
─────────────────────────────────────────────────────
Summary: 19 secrets checked — 12 passed, 7 not testable, 0 missing, 0 failed
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
| Symbol | Meaning |
|---|---|
✓ | Secret exists and API test passed |
✗ | Secret missing or API test failed (error details shown) |
· | Secret exists but not testable (client IDs, URNs, URIs) |
⚠ | OAuth token expired — re-auth needed (instructions shown) |
For each failed or expired secret, display remediation instructions inline:
Run: $OUTWORKOS_ROOT/scripts/set-secret.sh <label> <value>Run: $OUTWORKOS_ROOT/scripts/google-auth.shRe-authorize at https://www.linkedin.com/developers/apps — generate new tokens and store via set-secret.shRegenerate at https://supabase.com/dashboard/account/tokensRegenerate at https://app.netlify.com/user/applications#personal-access-tokensRegenerate at https://console.anthropic.com/settings/keysFind token at https://app.todoist.com/app/settings/integrations/developerRegenerate at https://elevenlabs.io/app/settings/api-keysRegenerate at https://app.fireflies.ai/integrations/custom/firefliesCheck at https://pushover.net/appsCheck at https://www.scrapingdog.com/dashboardAfter generating the report, if there are ANY missing or failed secrets (status ✗), send a Pushover notification summarizing the issues. Do not send a notification if everything is healthy.
bash "$OUTWORKOS_ROOT/skills/notify-user/send-pushover.sh" \
"Vault Health: {N} issue(s)" \
"{list of failed/missing secret labels, one per line}"
Example message for 2 issues:
elevenlabs_api_key: FAIL (401)
linkedin_refresh_token: MISSING
Keep the message concise — just the label and status. The full remediation details are in the terminal output and log file.
Do not alert for secrets marked as · (exists, not testable) — only for ✗ (missing/failed) and ⚠ (expired OAuth).
pushover_api_token and pushover_user_key together — tested as a pair.supabase_service_role_key is excluded from checks — it lives in macOS Keychain (not Vault) as the bootstrap credential needed to access Vault itself./setup-project to verify all secrets are in place, or whenever API calls start failing unexpectedly.