secrets-management

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

1.12x

Quality

56%

Does it follow best practices?

Impact

92%

1.12x

Average score across 6 eval scenarios

Securityby

Advisory

Suggest reviewing before use

Optimize this skill with Tessl

npx tessl skill review --optimize ./plugins/cicd-automation/skills/secrets-management/SKILL.md

Evaluation results

100%

12%

Secure Deployment Pipeline with HashiCorp Vault

GitHub Actions Vault integration

Criteria

Without context

With context

Vault action version

100%

kv-v2 path format

100%

Secret masking

100%

GitHub environment scoping

100%

No hardcoded secrets

100%

VAULT_TOKEN reference

100%

Database credentials retrieved

100%

Payment API key retrieved

100%

Secrets requirements documented

100%

Main branch trigger

100%

57%

13%

Preventing Secret Leakage in a Development Repository

Secret scanning setup

Criteria

Without context

With context

TruffleHog in pre-commit

Docker invocation pattern

Commit blocking on failure

GitLab secret-scan job

100%

TruffleHog in CI

100%

allow_failure: false

100%

Security stage placement

100%

Hook executable

Installation documented

55%

100%

False positive guidance

100%

Migrating Kubernetes Workloads to Dynamic Secret Injection

Kubernetes External Secrets Operator

Criteria

Without context

With context

ESO apiVersion

100%

SecretStore kind

100%

ExternalSecret kind

100%

refreshInterval set

100%

creationPolicy Owner

100%

Correct secret target

100%

Both fields mapped

100%

AWS credentials action version

100%

No hardcoded AWS credentials

100%

Production namespace

100%

Architecture documented

100%

Ownership model explained

100%

35%

Secure the Payments Service Deployment Pipeline

GitLab CI Vault integration

Criteria

Without context

With context

vault:latest image

100%

VAULT_ADDR exported

80%

100%

VAULT_TOKEN exported

50%

100%

vault kv get retrieval

100%

Database password field

75%

100%

API key field

75%

100%

No hardcoded secrets

100%

Protected variable explained

100%

Masked variable explained

100%

Environment-specific secrets

100%

apk dependencies

100%

Provision a Production Database with Secrets from AWS Secrets Manager

AWS Secrets Manager with Terraform and GitHub Actions

Criteria

Without context

With context

Terraform data source type

100%

jsondecode password extraction

100%

Correct secret_id

100%

configure-aws-credentials version

100%

AWS credentials from secrets

100%

get-secret-value CLI flags

100%

Secret masking

100%

No hardcoded credentials

100%

IAM permissions documented

100%

Least privilege noted

100%

96%

Build an Automated Database Password Rotation System

Automated secret rotation

Criteria

Without context

With context

boto3 secretsmanager client

100%

get_secret_value call

100%

json.loads on SecretString

100%

Username preserved

100%

put_secret_value call

100%

Correct secret ID used

100%

Manual rotation steps

66%

Audit logging explained

100%

Short-lived tokens recommended

100%

lambda_handler signature

100%

No hardcoded passwords

100%

Repository: wshobson/agents
Commit: 70444e5

Evaluated: about 1 month ago
Agent: Claude Code
Model: Claude Sonnet 4.6

Table of Contents

Secure Deployment Pipeline with HashiCorp Vault Preventing Secret Leakage in a Development Repository Migrating Kubernetes Workloads to Dynamic Secret Injection Secure the Payments Service Deployment Pipeline Provision a Production Database with Secrets from AWS Secrets Manager Build an Automated Database Password Rotation System

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.