Back to catalog / Security
Secrets management: migrate to least privilege and recoverable rotation
Move pipeline credentials to a controlled secret manager and plan safe rotation.
Skills
Inventory credential purpose, consumers, environments, and permissions without reading or echoing secret values. Choose Vault, AWS Secrets Manager, Azure Key Vault, or platform storage, granting the runtime identity access only to the needed secret/path; CI should inject references or short-lived credentials. Rehearse overlap of old/new credentials, consumer switch, verification, and revocation in test first, with a recovery window. After updating pipeline/IaC, scan logs, config, and repository for remaining plaintext. Production rotation/revocation requires impact review and approval.
Permissions
Prerequisites
- For storing, granting, and rotating CI/CD, application, or database credentials.
- Identify secret types, consumers, runtime, and available secret manager.
Permissions
- May edit pipeline/IaC secret references; rotation can invalidate active credentials.
- Never reveal secret values; confirm service impact and rollback before rotation/revocation.
Limitations
Prefer short-lived/dynamic least-privilege credentials; verify references/versions without printing values; plan rotation recovery.
Pinned upstream source
- Repository
- wshobson/agents
- File path
- plugins/cicd-automation/skills/secrets-management/SKILL.md
- Pinned commit
46891e7e60da0e52baf1050b7b6391b64e84c6d9- Source checked
- 2026-10-14 · Reviewed against the pinned upstream source
Repository metrics
These values describe the upstream repository, not popularity or likes for an individual skill or playbook.
- Stars
- Not collected
- Forks
- Not collected
- Observed at
- Not collected
No metrics snapshot is available yet.
License: MIT
Compatible tools
Secret manager API/CLI · CI secret store · Rotation workflow
Main topic
Make Agent behavior safer and easier to verify