secrets-management
Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.
72
Quality
88%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
Securityby
Passed
No findings from the security scan
Secrets Management
Rules:
- Never hardcode secrets in source files, configs committed to git, or logs.
- Use environment variables for local development (
python-dotenv). - Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
- Add
.envand*.pemto.gitignorebefore the first commit. - Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).
Scanning: Use ggshield, truffleHog, or git-secrets in CI to block secret commits.
Anti-patterns:
os.environ.get('KEY', 'hardcoded_default')in production code.- Logging full request/response bodies that may contain tokens.
- Repository
- aiming-lab/MetaClaw
- Commit
922caf3
- Last updated
- First committed
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.