secrets-management

Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.

Quality

88%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

Passed

No findings from the security scan

Quality

Content

87%Weight 40%Scale 1-3

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A tight, highly actionable reference whose only gap is workflow framing — it presents practices as a checklist rather than a sequenced process with explicit verification checkpoints.

Suggestions

Frame the rules as a short sequenced workflow with an explicit verification checkpoint, e.g. 'Before commit: run ggshield/truffleHog; if a secret is found, rotate it and re-scan before proceeding.'

Add one copy-paste happy-path example (e.g. a python-dotenv or Vault retrieval snippet) to complement the anti-pattern snippet.

Dimension	Reasoning	Score
Conciseness	The body is a lean set of bullets with no padding or explanation of concepts Claude already knows; every line earns its place, matching the score-3 anchor.	3 / 3
Actionability	It names concrete tools (python-dotenv, AWS Secrets Manager, Vault, 1Password CLI, ggshield, truffleHog, git-secrets), gives copy-paste gitignore entries, and a concrete anti-pattern code snippet, providing actionable guidance for an instruction-style skill.	3 / 3
Workflow Clarity	Rules are numbered and a detect→rotate loop is implied (Scanning plus rule 5), but it reads as a parallel checklist rather than a sequenced process with explicit validation checkpoints, so it does not reach the score-3 anchor.	2 / 3
Progressive Disclosure	The skill is under 50 lines, needs no external references (no bundle files exist), and is organized into clear sections (Rules, Scanning, Anti-patterns), satisfying the simple-skill allowance for a 3.	3 / 3
	Total	11 / 12 Passed

Description

90%Weight 40%Scale 1-3

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description with explicit use-triggers and good natural keyword coverage, narrowly held back from a perfect score by the vague 'handling' action verb in the capability description.

Suggestions

Replace the vague verb 'handling' with concrete actions, e.g. 'Store, rotate, and prevent leakage of API keys, passwords, tokens, and private keys.'

Dimension	Reasoning	Score
Specificity	It names the credential domain and one concrete action ('Never hardcode secrets in source code'), but the primary verb 'handling' is vague and it stops short of listing multiple specific concrete actions, so it matches the score-2 anchor rather than 3.	2 / 3
Completeness	It states what the skill does ('handling…sensitive credential', 'Never hardcode secrets') and gives explicit when-triggers ('Use this skill when handling…', 'apply this whenever the word… appears'), clearly answering both what and when.	3 / 3
Trigger Term Quality	It enumerates natural terms users would actually say — 'API keys, passwords, tokens, private keys' and explicitly 'key', 'token', 'password', or 'secret' — giving good coverage, matching the score-3 anchor.	3 / 3
Distinctiveness Conflict Risk	Secrets/credential management is a clear niche with distinct, credential-specific triggers (key/token/password/secret), making it unlikely to fire for unrelated skills.	3 / 3
	Total	11 / 12 Passed

Validation

93%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 15 / 16 Passed

Validation for skill structure

Criteria	Description	Result
frontmatter_unknown_keys	Unknown frontmatter key(s) found; consider removing or moving to metadata	Warning

	Total	15 / 16 Passed

Repository: aiming-lab/MetaClaw
Path: memory_data/skills/secrets-management/SKILL.md
Commit: 922caf3

Reviewed: 9 days ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.