skills.rest
mindcockpit-ai
mindcockpit-aiOFFICIAL
Explore all skills by this author →
WebsiteGitHub

secrets-setup

Scan repositories for plaintext secrets and generate env.tpl templates.

11|1|Updated Feb 9, 2026
Search Tags:#security#secrets#vault#ci-cd#workflows#1password#env.tpl
One-click install
npx skills add https://github.com/mindcockpit-ai/cognitive-core --skill secrets-setup
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-setup
Source: https://github.com/mindcockpit-ai/cognitive-core/tree/main/core/skills/secrets-setup
Command: npx skills add https://github.com/mindcockpit-ai/cognitive-core --skill secrets-setup

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Platform-agnostic secrets management to prevent plaintext credentials in code and CI/CD, by leveraging 1Password CLI to inject secrets securely with full auditability across development and release pipelines.

Core Features & Use Cases

  • Secrets discovery: scans repositories for plaintext credentials and replaces them with op:// references.
  • Env template generation: creates .env.tpl templates that map environment variables to 1Password references for safe runtime injection.
  • CI/CD hardening: patches GitHub Actions workflows to load secrets and enforces fallback-friendly patterns for secrets.
  • Use Case: Onboarding a new project, connect the vault, generate templates, patch workflows, and verify hooks to avoid leaking credentials.

Quick Start

Run a full scan to detect plaintext secrets and initialize an env.tpl template for your project.

Frequently Asked Questions about secrets-setup

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan a repository for plaintext secrets and replace them with 1Password references?▼

Scanning repositories for plaintext secrets involves identifying exposed credentials and replacing them with op:// references. This process uses 1Password CLI to ensure secure runtime injection and generates .env.tpl templates mapping environment variables safely.

How do I inject secrets securely in GitHub Actions workflows without hardcoding credentials?▼

Injecting secrets securely in GitHub Actions workflows requires patching your CI configuration to load credentials via 1Password CLI. This enforces fallback-friendly patterns and replaces plaintext environment variables with encrypted op:// references for full auditability.

What is an env.tpl template for managing environment variables with 1Password?▼

An env.tpl template is a generated file mapping environment variables to 1Password references. It enables safe runtime injection of credentials via 1Password CLI, ensuring zero plaintext secrets exist in your local development or CI/CD environments.

Do I need 1Password CLI installed locally to enforce encrypted secret handling in my projects?▼

Yes, enforcing encrypted secret handling requires the 1Password CLI (op) to scan repositories, generate env.tpl templates, patch CI workflows, and verify security hooks. The CLI injects op:// references to prevent plaintext credentials in code.

What's the best way to onboard a new project to prevent plaintext credentials in code and CI/CD?▼

Onboarding a new project to prevent plaintext credentials involves scanning for exposed secrets, connecting a 1Password vault, generating env.tpl templates, patching GitHub Actions workflows, and verifying security hooks for full auditability.

How do I verify that security hooks for secrets management are working in my CI/CD pipeline?▼

Verifying security hooks for secrets management involves running a status check on your CI/CD pipeline. This validates that GitHub Actions workflows load secrets via 1Password CLI and confirms that zero plaintext credentials remain in your repositories.

Related Skills

Explore More Software Engineering Skills→
anilcan-karaanilcan-kara

1password

Read and inject secrets using the 1Password CLI across environments.

Community
Intermediate
majesticlabs-devmajesticlabs-dev
47

onepassword-cli-coder

Integrate 1Password CLI secret loading into development workflows.

Official
Advanced
Jem-OpenJem-Open
3

1password-secret-references

Wrap secret-reliant commands with op run to prevent plaintext exposure.

Official
Intermediate
nateberkopecnateberkopec
111

env-to-fnox

Migrates plaintext .env secrets to fnox-backed management using 1Password and mise.

Community
Advanced