What problem does it solve? Adding a new credential to a SOPS/age-encrypted Ansible secrets file involves several error-prone steps: encrypting without leaking the value, classifying the secret's rotation tier, referencing it in templates, and registering it for rotation tracking. This Skill walks through that entire flow safely, ensuring secrets never appear in transcripts, shell history, or plaintext git diffs. ## Core Features & Use Cases - Safe secret insertion: Generates or accepts secret values without echoing them, using sops set piped from openssl rand so values never hit the transcript. - Tier classification: Distinguishes pinned (break-glass, do-not-rotate), auto (locally generated), and assisted/external secrets, routing each to the correct handling procedure. - Rotation registration: Runs secret_rotation.py sync and audit to reconcile the plaintext rotation registry with live secret names and assign staggered due dates. - Host onboarding: Documents the bootstrap flow for adding a new host's age public key to .sops.yaml so it can decrypt shared secrets. - Use Case: You need to add an Uptime Kuma push token for a new monitor. The Skill generates a 32-hex-character token (not base64, which AutoKuma rejects), writes it encrypted, registers it for rotation, and tells you which template to update. ## Quick Start Ask the assistant to add a new secret named my_api_token to the encrypted secrets file and register it for rotation tracking.
