Description
secrets-management is an agent skill from the wshobson/agents collection for handling secrets securely in CI/CD pipelines. Secrets are API keys, credentials, database passwords and TLS certificates, and the skill's purpose is to keep them out of code and configuration files while still letting pipelines and applications use them. It covers HashiCorp Vault and AWS Secrets Manager, along with the native secret stores that platforms provide, and explains how to choose among them. The skill applies when storing API keys and credentials, managing database passwords, handling TLS certificates, rotating secrets automatically so a leaked value stops working soon, and implementing least-privilege access so each job or service can read only the secrets it needs. Its central rule is to avoid hardcoding sensitive information anywhere in a repository or a pipeline definition. Secrets management touches the security of every system a team runs, so the agent's configuration should be reviewed by the people responsible for access and recovery, and tested so that a rotation does not break the services that depend on the secret. The skill is installed with the skills CLI from the wshobson/agents repository. Its skills.sh page showed about 12.9K installs and passing results from three security audits at the time of the scan.…
Highlights
- HashiCorp Vault and AWS Secrets Manager
- Native platform secret stores
- Automatic secret rotation
- Least-privilege access
- No hardcoded credentials in pipelines
- Installs with the skills CLI
Ratings & Reviews
No ratings yet
Be the first to rate secrets-management.
People also visit
secrets-management FAQ
What counts as a secret here?
API keys, credentials, database passwords and TLS certificates.
Which tools does it cover?
HashiCorp Vault, AWS Secrets Manager and native platform solutions.
Does it cover rotation?
Yes. Rotating secrets automatically is one of the uses.
What is least-privilege access?
Giving each job or service access only to the secrets it needs, which the skill covers.
How do I install it?
Run npx skills add https://github.com/wshobson/agents --skill secrets-management.
What security audits does it have?
skills.sh lists three audits: Gen Agent Trust Hub Pass, Socket Pass and Snyk Pass.
What are the best secrets-management alternatives?
Popular alternatives to secrets-management include opensource-pipeline, attack-tree-construction and gitlab-ci-patterns. See all secrets-management alternatives