CtrlK
BlogDocsLog inGet started
Tessl Logo

testland/secrets-rotation-runner

Build-an-X for the secret-rotation workflow after detection - detect via gitleaks/trufflehog/kingfisher → identify provider via verifier → rotate via provider API (AWS IAM / GitHub PAT / Stripe / GCP / Azure / Twilio / Slack / etc.) → invalidate old secret → audit log via observability stack → post-mortem cross-ref. Use when a secret is detected in code (or proactively for periodic rotation) - assume git-history scrub does NOT prevent compromise.

71

Quality

89%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

SecuritybySnyk

Medium

Suggest reviewing before use

Overview
Quality
Evals
Security
Files

Quality

Content

81%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

A comprehensive, executable rotation runbook with strong validation checkpoints and an end-to-end checklist. The weakest dimension is conciseness due to motivational framing, and progressive disclosure could benefit from splitting detailed tables into reference files.

Suggestions

Trim the Overview's motivational prose ('Detecting a leaked secret in code is the easy part...') to a one-line critical-assumption statement to improve conciseness.

Move the Step 7 rotation-cadence table and Step 8 tooling-integration list into a separate references/ file (e.g. references/cadence-and-tooling.md) and link to it from the body, tightening the overview.

For non-AWS providers currently given only dashboard pointers (Stripe, Twilio, Slack), add at least one scripted rotation command or explicitly justify the manual-only treatment to keep actionability uniform across the table.

DimensionReasoningScore

Conciseness

Largely action-oriented but includes motivational prose ('Detecting a leaked secret in code is the easy part... is the hard part') and explanatory framing that could be trimmed without losing value.

3 / 5

Actionability

Provides copy-paste-ready bash (AWS IAM create/deactivate/delete with jq parsing, CloudTrail lookup), a per-provider rotation-API table, and three named strategies with numbered steps covering the common cases.

5 / 5

Workflow Clarity

Steps 1–9 are clearly sequenced with explicit validation checkpoints (verify consumers via audit logs, observation window before delete, Step 4 audit, Step 9 end-to-end checklist), so the destructive-operation cap does not apply.

5 / 5

Progressive Disclosure

Well-organized sections with a clear References list and no nested file references, but no bundled reference files exist and the single ~250-line file carries tables (cadence, tooling) that could be split out for a cleaner overview.

4 / 5

Total

17

/

20

Passed

Description

92%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong, concrete description that clearly states the workflow's scope and explicit use-when triggers with minimal conflict risk. The only gap is slightly fewer verbatim natural user phrasings for the trigger terms.

DimensionReasoningScore

Specificity

Lists the full rotation pipeline (detect → identify → rotate → invalidate → audit → post-mortem) with a concrete provider list (AWS IAM / GitHub PAT / Stripe / GCP / Azure / Twilio / Slack), matching the comprehensive-coverage anchor.

5 / 5

Completeness

Explicitly answers both what (the rotation workflow steps) and when ('Use when a secret is detected in code (or proactively for periodic rotation)') with concrete trigger phrases.

5 / 5

Trigger Term Quality

Includes natural triggers like 'a secret is detected in code' and 'proactive periodic rotation', but omits common user phrasings such as 'leaked key' or 'rotate my AWS key' that would warrant a 5.

4 / 5

Distinctiveness Conflict Risk

Targets a narrow niche (rotation after detection, explicitly distinct from the sister scanning skills) with triggers unlikely to fire for unrelated skills.

5 / 5

Total

19

/

20

Passed

Validation

100%

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation16 / 16 Passed

Validation for skill structure

No warnings or errors.

Reviewed

Table of Contents