secrets-management
Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.
52
56%
Does it follow best practices?
Impact
—
No eval scenarios have been run
Advisory
Suggest reviewing before use
Optimize this skill with Tessl
npx tessl skill review --optimize ./plugins/cicd-automation/skills/secrets-management/SKILL.mdQuality
Discovery
89%Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.
This is a solid skill description that clearly defines its niche at the intersection of secrets management and CI/CD pipelines. It excels in completeness with an explicit 'Use when' clause and includes good trigger terms. The main weakness is that the specific actions could be more granular—listing concrete tasks like configuring secret rotation policies, injecting secrets into build steps, or auditing secret access would strengthen it.
Suggestions
Add more concrete actions beyond 'implement' — e.g., 'configure secret rotation policies, inject secrets into pipeline steps, set up dynamic credentials, audit secret access logs'.
| Dimension | Reasoning | Score |
|---|---|---|
Specificity | Names the domain (secrets management for CI/CD) and mentions specific tools (Vault, AWS Secrets Manager), but the actions are somewhat general ('implement', 'handling', 'rotating', 'securing') rather than listing multiple concrete discrete actions like 'configure secret rotation policies, inject secrets into pipeline steps, set up dynamic credentials'. | 2 / 3 |
Completeness | Clearly answers both 'what' (implement secure secrets management for CI/CD using Vault, AWS Secrets Manager, or native platform solutions) and 'when' (Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments) with an explicit 'Use when...' clause. | 3 / 3 |
Trigger Term Quality | Includes strong natural keywords users would say: 'secrets management', 'CI/CD pipelines', 'Vault', 'AWS Secrets Manager', 'credentials', 'rotating secrets'. These cover common terms a user would naturally use when needing this skill. | 3 / 3 |
Distinctiveness Conflict Risk | The combination of secrets management + CI/CD pipelines + specific tools (Vault, AWS Secrets Manager) creates a clear niche that is unlikely to conflict with general CI/CD skills or general security skills. The triggers are distinct enough to avoid false matches. | 3 / 3 |
Total | 11 / 12 Passed |
Implementation
22%Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.
This skill reads more like a reference catalog of secrets management tools than an actionable guide. It covers too many tools at surface level without providing clear workflows, validation steps, or error recovery for any of them. The content is verbose with feature lists and generic best practices that Claude already knows, while lacking the depth and structure needed to reliably execute secrets management tasks.
Suggestions
Pick one or two primary tools (e.g., Vault + GitHub Actions) for the main SKILL.md and move other tool integrations to separate reference files to reduce verbosity and improve progressive disclosure.
Add explicit validation checkpoints to workflows — e.g., after storing a secret, verify retrieval; after rotation, verify the application still authenticates; include rollback steps if verification fails.
Remove the feature bullet lists for each tool (Claude knows what AWS Secrets Manager and Azure Key Vault do) and replace with only the specific commands/configs needed to integrate them into CI/CD pipelines.
Complete the incomplete code examples — provide actual implementations for generate_strong_password() and update_database_password(), or replace the rotation example with a fully working AWS rotation configuration using native rotation templates.
| Dimension | Reasoning | Score |
|---|---|---|
Conciseness | The skill is extremely verbose, listing feature bullet points for tools Claude already knows (e.g., 'Azure Key Vault: HSM-backed keys, Certificate management'), explaining what GitHub Secrets and GitLab CI variables are, and including a 10-item best practices list of generic advice. Much of this content is padding that doesn't add actionable value. | 1 / 3 |
Actionability | There are concrete code examples (bash, YAML, Python, HCL, Kubernetes manifests) that are mostly executable, but several are incomplete — the rotation Lambda references undefined functions (generate_strong_password, update_database_password), the Vault dev server setup uses a root token which is not production-ready, and many examples end with placeholder comments like '# Use $DB_PASSWORD'. The breadth sacrifices depth. | 2 / 3 |
Workflow Clarity | There is no clear end-to-end workflow with validation checkpoints. The manual rotation process lists steps but has no verification or rollback guidance. Secret scanning is shown but not integrated into a workflow with feedback loops. For operations involving credential rotation (destructive/risky), the lack of validation steps and error recovery is a significant gap. | 1 / 3 |
Progressive Disclosure | The content references `references/vault-setup.md` and `references/github-secrets.md`, and lists related skills, showing some attempt at progressive disclosure. However, no bundle files exist to support these references, and the main file is a monolithic wall covering 5+ tools with inline details that should be split into separate reference files. | 2 / 3 |
Total | 6 / 12 Passed |
Validation
100%Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.
Validation — 11 / 11 Passed
Validation for skill structure
No warnings or errors.
- Repository
- wshobson/agents
- Commit
112197c
- Reviewed
Table of Contents
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.