Skip to content
Get packs

Secrets Management for CI/CD

Guides an agent to set up secure handling of API keys and passwords in CI/CD pipelines using Vault or cloud secret stores

Source Download skill
Repository
wshobson/agents
Stars
42,095
Licence
MIT
Files
1 file

What it does

This skill gives an AI agent a reference guide for keeping passwords, API keys and certificates out of code and build pipelines. When installed, the agent can draft setup steps and config for HashiCorp Vault, AWS Secrets Manager, Azure Key Vault or Google Secret Manager, and show how GitHub Actions, GitLab CI and Kubernetes can read those secrets at run time. It also brings in best-practice checklists, a rotation outline and a pre-commit secret-scanning example.

Great for

  • Developers setting up or reviewing how a CI/CD pipeline gets its database passwords and API keys
  • DevOps engineers who want a starting template for Vault or AWS Secrets Manager integration
  • Teams moving away from hardcoded credentials in repositories

Skip it if

  • Production secret handling without review: the examples use a Vault dev server, a root token and a plaintext password, which are unsafe outside testing
  • Anyone expecting a complete, audited security solution; the file is a general guide and does not verify your specific setup

Try asking

  • “Set up HashiCorp Vault for our GitHub Actions deploy so the database password is pulled at run time”
  • “Show me how to move our hardcoded API keys in GitLab CI into AWS Secrets Manager”
  • “Write a pre-commit hook that scans for leaked secrets before I commit”
Step-by-step guide: how to use Secrets Management for CI/CDInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 1 original files, the MIT licence and an attribution note.

    secrets-management.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip secrets-management.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip secrets-management.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Ask the agent to replace the sample dev-server and root-token steps with your real Vault or cloud auth method before running anything
  • Review any generated pipeline file for secret values echoed into logs, and confirm masking is enabled
  • Give the agent only scoped, least-privilege credentials when it helps you configure cloud secret stores

What's inside

  • SKILL.md

Redistributed unmodified from wshobson/agents under the MIT licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.