What problem does it solve? Managing Agenix secrets in a NixOS flake risks leaking plaintext into the Nix store, Git history, logs, or chat output. This Skill enforces a strict no-plaintext workflow for auditing and modifying secret declarations, recipient mappings, and runtime wiring in the nixcf repository. ## Core Features & Use Cases - Safety-gated inspection: A bundled shell script checks for tracked plaintext credential files and blocks all repo-consuming Nix commands until the gate passes. - Classified request handling: Every task is classified as audit, declaration/runtime wiring, recipient change, credential rotation, or Git-history remediation, with explicit authorization gates before material actions. - Cross-layer credential tracing: Maps the full chain from logical secret to encrypted payload, recipients, age.secrets declarations, runtime paths, and consumers, including the Attic client/server/netrc path across Home Manager, NixOS, and the Pi host. - Use Case: When adding a new Agenix secret for a service, the Skill wires the declaration and consumer with least-privilege ownership, then hands the actual encryption step to the user in a trusted local session. ## Quick Start Ask the agent to audit the Agenix secret declarations and their consumers in this repository without reading any encrypted payload contents.
