What problem does it solve? Handling credentials, tokens, and keys across code and deployments is error-prone: secrets leak into source control, rotations break runtime consumers, and long-lived static keys accumulate risk. This Skill provides a structured process for adding, rotating, and auditing secrets without exposing values. ## Core Features & Use Cases - Safe Secret Lifecycle Management: Separates creation, rotation, consumption, and rollback concerns, with mandatory approval gates and verified rollback paths before any production rotation. - Modern Identity Patterns: Prefers OIDC workload identity federation, SPIFFE/SVID issuance, and short-lived WIMSE-style tokens over static long-lived access keys in CI/CD. - Leak Prevention & Scanning: Enforces pre-commit and CI secret scanning with Gitleaks or TruffleHog, SOPS with age or Cloud KMS for Git-stored secrets, and namespace-scoped External Secrets Operator stores. - Use Case: When rotating a database credential used by a Kubernetes deployment, the Skill guides you to classify the secret, verify consumers tolerate old and new credentials, emit a name-only incident-report.json for audit, and confirm runtime validation before marking the rotation complete. ## Quick Start Use the manage-secrets skill to rotate the API token for the payment service and verify the deployment consumers pick up the new value safely.
