New: 98,000+ skills indexed from GitHub repos with 100+ stars · every skill safety-checkedBrowse top skillsTop skills
Esc to closeBrowse all skills
Submit a skillBrowse skills
Submit a skillBrowse skills

Agent skill

Secrets Management

by davila7 in davila7/claude-code-templates

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

MITAuto-check passedDevOps & Cloud

Install Secrets Management

skills CLI
$ npx skills add davila7/claude-code-templates --skill secrets-management -a claude-code

Project install by default; add -g for ~/.claude/skills/.

GitHub CLI
$ gh skill install davila7/claude-code-templates secrets-management --agent claude-code

Project scope by default; add --scope user for a personal install. Needs GitHub CLI 2.90.0 or later (public preview).

Manual copy
$ git clone --depth 1 https://github.com/davila7/claude-code-templates.git skills-src && mkdir -p .claude/skills && cp -r skills-src/cli-tool/components/skills/security/secrets-management .claude/skills/secrets-management && rm -rf skills-src

Use ~/.claude/skills/ instead of .claude/skills for a personal install. The folder must contain SKILL.md.

Claude Code skills documentation · loads skills from .claude/skills/

Facts

Skill name
secrets-management
GitHub stars
32k
Used in
12 other repos
Token cost
~2k tokens
SKILL.md length
364 words
Files
1
Skills in repo
478
Repo updated
First seen
Licence
MIT

At a glance

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

  • Works in 4 steps: Identify secret types, owners, and… → Choose a secrets backend and access model. → Integrate CI/CD or runtime retrieval… → …
  • Tasks that involve Secrets management
  • SKILL.md covers Purpose, Use this skill when, Do not use this skill when and Instructions, plus 9 more sections
  • Calls vault, aws and docker; needs DB_PASSWORD and API_KEY

What it does

Secrets Management is an agent skill from davila7/claude-code-templates. Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

Its SKILL.md is about 2k tokens, which your agent loads only when the skill is triggered. It is a single SKILL.md file with no bundled scripts.

It sits in DevOps & Cloud, covering Secrets management and CI/CD. It works with Amazon Web Services, GitHub and HashiCorp Vault. The repository describes itself as: CLI tool for configuring and monitoring Claude Code. The licence is MIT.

When your agent uses it

  • Tasks that involve Secrets management
  • Tasks that involve CI/CD

Example prompts

  • “/secrets-management”

Requirements

  • Python 3
  • Docker
  • A credential in VAULT_TOKEN
  • A credential in API_KEY

Workflow steps

4 steps, taken from the first numbered list in SKILL.md.

  1. Identify secret types, owners, and rotation requirements.
  2. Choose a secrets backend and access model.
  3. Integrate CI/CD or runtime retrieval with least privilege.
  4. Validate rotation and audit logging.

What it can do on your machine

Read from SKILL.md and the folder at commit 46b4d8b. It shows what the files ask for, not the result of running them.

  • Tool permissions

    Pre-approves nothing: there is no allowed-tools line, so your agent's usual permission prompts apply.

    From allowed-tools in the SKILL.md frontmatter.

  • Runs code

    Shell commands in SKILL.md call:

    • vault
    • aws
    • docker

    From the folder's file list and the shell code blocks in SKILL.md.

  • Network

    No URLs in SKILL.md. Its commands use aws and docker, which can reach the network depending on how they are called.

    From URLs in SKILL.md, links to its own repository left out.

  • Credentials

    Names these keys or tokens, usually read from environment variables:

    • DB_PASSWORD
    • API_KEY
    • VAULT_TOKEN
    • AWS_ACCESS_KEY_ID
    • AWS_SECRET_ACCESS_KEY
    • PROD_API_KEY

    From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Secrets Management loads about 2k tokens when it runs. Until then it costs about 31 tokens; SKILL.md has 364 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it
~31
When it runs · the whole SKILL.md, loaded when a task matches
~2k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

Auto-check passed

The automated check found no risky patterns in SKILL.md.

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

The full file from davila7/claude-code-templates at commit 46b4d8b, republished under its MIT licence (© davila7). 364 words, ~2,014 tokens.

Download SKILL.mdSave it as .claude/skills/secrets-management/SKILL.md (or your agent's skills folder).
name
secrets-management
description
Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.
risk
unknown
source
community
date_added
2026-02-27

Secrets Management

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

Purpose

Implement secure secrets management in CI/CD pipelines without hardcoding sensitive information.

Use this skill when

  • Store API keys and credentials
  • Manage database passwords
  • Handle TLS certificates
  • Rotate secrets automatically
  • Implement least-privilege access

Do not use this skill when

  • You plan to hardcode secrets in source control
  • You cannot secure access to the secrets backend
  • You only need local development values without sharing

Instructions

  1. Identify secret types, owners, and rotation requirements.
  2. Choose a secrets backend and access model.
  3. Integrate CI/CD or runtime retrieval with least privilege.
  4. Validate rotation and audit logging.

Safety

  • Never commit secrets to source control.
  • Limit access and log secret usage for auditing.

Secrets Management Tools

HashiCorp Vault
  • Centralized secrets management
  • Dynamic secrets generation
  • Secret rotation
  • Audit logging
  • Fine-grained access control
AWS Secrets Manager
  • AWS-native solution
  • Automatic rotation
  • Integration with RDS
  • CloudFormation support
Azure Key Vault
  • Azure-native solution
  • HSM-backed keys
  • Certificate management
  • RBAC integration
Google Secret Manager
  • GCP-native solution
  • Versioning
  • IAM integration

HashiCorp Vault Integration

Setup Vault
bash
# Start Vault dev server
vault server -dev

# Set environment
export VAULT_ADDR='http://127.0.0.1:8200'
export VAULT_TOKEN='root'

# Enable secrets engine
vault secrets enable -path=secret kv-v2

# Store secret
vault kv put secret/database/config username=admin password=secret
GitHub Actions with Vault
yaml
name: Deploy with Vault Secrets

on: [push]

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: actions/checkout@v4

    - name: Import Secrets from Vault
      uses: hashicorp/vault-action@v2
      with:
        url: https://vault.example.com:8200
        token: ${{ secrets.VAULT_TOKEN }}
        secrets: |
          secret/data/database username | DB_USERNAME ;
          secret/data/database password | DB_PASSWORD ;
          secret/data/api key | API_KEY

    - name: Use secrets
      run: |
        echo "Connecting to database as $DB_USERNAME"
        # Use $DB_PASSWORD, $API_KEY
GitLab CI with Vault
yaml
deploy:
  image: vault:latest
  before_script:
    - export VAULT_ADDR=https://vault.example.com:8200
    - export VAULT_TOKEN=$VAULT_TOKEN
    - apk add curl jq
  script:
    - |
      DB_PASSWORD=$(vault kv get -field=password secret/database/config)
      API_KEY=$(vault kv get -field=key secret/api/credentials)
      echo "Deploying with secrets..."
      # Use $DB_PASSWORD, $API_KEY

Reference: See references/vault-setup.md

AWS Secrets Manager

Store Secret
bash
aws secretsmanager create-secret \
  --name production/database/password \
  --secret-string "super-secret-password"
Retrieve in GitHub Actions
yaml
- name: Configure AWS credentials
  uses: aws-actions/configure-aws-credentials@v4
  with:
    aws-access-key-id: ${{ secrets.AWS_ACCESS_KEY_ID }}
    aws-secret-access-key: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
    aws-region: us-west-2

- name: Get secret from AWS
  run: |
    SECRET=$(aws secretsmanager get-secret-value \
      --secret-id production/database/password \
      --query SecretString \
      --output text)
    echo "::add-mask::$SECRET"
    echo "DB_PASSWORD=$SECRET" >> $GITHUB_ENV

- name: Use secret
  run: |
    # Use $DB_PASSWORD
    ./deploy.sh
Terraform with AWS Secrets Manager
hcl
data "aws_secretsmanager_secret_version" "db_password" {
  secret_id = "production/database/password"
}

resource "aws_db_instance" "main" {
  allocated_storage    = 100
  engine              = "postgres"
  instance_class      = "db.t3.large"
  username            = "admin"
  password            = jsondecode(data.aws_secretsmanager_secret_version.db_password.secret_string)["password"]
}

GitHub Secrets

Organization/Repository Secrets
yaml
- name: Use GitHub secret
  run: |
    echo "API Key: ${{ secrets.API_KEY }}"
    echo "Database URL: ${{ secrets.DATABASE_URL }}"
Environment Secrets
yaml
deploy:
  runs-on: ubuntu-latest
  environment: production
  steps:
  - name: Deploy
    run: |
      echo "Deploying with ${{ secrets.PROD_API_KEY }}"

Reference: See references/github-secrets.md

GitLab CI/CD Variables

Show full SKILL.md (146 more words)Show less
Project Variables
yaml
deploy:
  script:
    - echo "Deploying with $API_KEY"
    - echo "Database: $DATABASE_URL"
Protected and Masked Variables
  • Protected: Only available in protected branches
  • Masked: Hidden in job logs
  • File type: Stored as file

Best Practices

  1. Never commit secrets to Git
  2. Use different secrets per environment
  3. Rotate secrets regularly
  4. Implement least-privilege access
  5. Enable audit logging
  6. Use secret scanning (GitGuardian, TruffleHog)
  7. Mask secrets in logs
  8. Encrypt secrets at rest
  9. Use short-lived tokens when possible
  10. Document secret requirements

Secret Rotation

Automated Rotation with AWS
python
import boto3
import json

def lambda_handler(event, context):
    client = boto3.client('secretsmanager')

    # Get current secret
    response = client.get_secret_value(SecretId='my-secret')
    current_secret = json.loads(response['SecretString'])

    # Generate new password
    new_password = generate_strong_password()

    # Update database password
    update_database_password(new_password)

    # Update secret
    client.put_secret_value(
        SecretId='my-secret',
        SecretString=json.dumps({
            'username': current_secret['username'],
            'password': new_password
        })
    )

    return {'statusCode': 200}
Manual Rotation Process
  1. Generate new secret
  2. Update secret in secret store
  3. Update applications to use new secret
  4. Verify functionality
  5. Revoke old secret

External Secrets Operator

Kubernetes Integration
yaml
apiVersion: external-secrets.io/v1beta1
kind: SecretStore
metadata:
  name: vault-backend
  namespace: production
spec:
  provider:
    vault:
      server: "https://vault.example.com:8200"
      path: "secret"
      version: "v2"
      auth:
        kubernetes:
          mountPath: "kubernetes"
          role: "production"

---
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
  name: database-credentials
  namespace: production
spec:
  refreshInterval: 1h
  secretStoreRef:
    name: vault-backend
    kind: SecretStore
  target:
    name: database-credentials
    creationPolicy: Owner
  data:
  - secretKey: username
    remoteRef:
      key: database/config
      property: username
  - secretKey: password
    remoteRef:
      key: database/config
      property: password

Secret Scanning

Pre-commit Hook
bash
#!/bin/bash
# .git/hooks/pre-commit

# Check for secrets with TruffleHog
docker run --rm -v "$(pwd):/repo" \
  trufflesecurity/trufflehog:latest \
  filesystem --directory=/repo

if [ $? -ne 0 ]; then
  echo "❌ Secret detected! Commit blocked."
  exit 1
fi
CI/CD Secret Scanning
yaml
secret-scan:
  stage: security
  image: trufflesecurity/trufflehog:latest
  script:
    - trufflehog filesystem .
  allow_failure: false

Reference Files

  • references/vault-setup.md - HashiCorp Vault configuration
  • references/github-secrets.md - GitHub Secrets best practices
  • github-actions-templates - For GitHub Actions integration
  • gitlab-ci-patterns - For GitLab CI integration
  • deployment-pipeline-design - For pipeline architecture

© davila7, MIT. Rendered from Markdown: HTML in the file is shown as text, images as links, and headings moved down two levels. Raw file

Files

Just SKILL.md in cli-tool/components/skills/security/secrets-management of davila7/claude-code-templates.

Open the folder on GitHubat commit 46b4d8b

Used in 12 other repositories

We found 34 copies of this SKILL.md (exact, near-identical or edited) in other folders, from 12 other GitHub owners. This page covers the copy in davila7/claude-code-templates, which our catalogue first saw on October 7, 2026.

Compare with similar skills

Secrets Management next to the 5 skills that share the most tags, products or categories with it. Stars are the repository's; “used in” counts other GitHub owners with a copy.

Secrets Management compared with similar skills
SkillStarsUsed inTokensAuto-checkLicenceRepo updated
Secrets Management this skilldavila7/claude-code-templates32k12 repos~2kAutomated safety check: PassMIT
Phase 9 Deploymentww-w-ai/bkit-claude-code601—~2.7kAutomated safety check: NotesApache-2.0
Hashicorp VaultBagelHole/DevOps-Security-Agent-Skills1.1k—~2kAutomated safety check: PassMIT
Secure GitHub Actionsvechain/x-app-template450—~1.2kAutomated safety check: PassMIT
Secrets Vault Manageralirezarezvani/claude-skills28k1 repos~3.6kAutomated safety check: NotesMIT
Implementing Secrets Management With Vaultmukul975/Anthropic-Cybersecurity-Skills34k—~3.2kAutomated safety check: PassApache-2.0

Similar skills

  • Phase 9 Deployment

    ww-w-ai/bkit-claude-code

    Deploy to production — CI/CD pipelines, environment config, deployment strategies.

    601 GitHub stars~2.7k tokensUpdated 12 days ago
    DevOps & CloudAuto-check: notes

  • Hashicorp Vault

    BagelHole/DevOps-Security-Agent-Skills

    Manage secrets and PKI with HashiCorp Vault. An agent skill from BagelHole/DevOps-Security-Agent-Skills.

    1.1k GitHub stars~2k tokensUpdated 4 mo ago
    DevOps & CloudAuto-check passed

  • Secure GitHub Actions

    vechain/x-app-template

    Secure GitHub Actions workflows against supply-chain, privilege, and shell-injection risks.

    450 GitHub stars~1.2k tokensUpdated 2 mo ago
    DevOps & CloudAuto-check passed

  • Secrets Vault Manager

    alirezarezvani/claude-skills

    A skill your agent uses when the user asks to set up secret management infrastructure, integrate HashiCorp Vault, configure cloud secret stores (AWS Secrets Manager, Azure Key Vault, GCP Secret…

    28k GitHub starsUsed in 1 repo~3.6k tokens
    DevOps & CloudAuto-check: notes

  • Implementing Secrets Management With Vault

    mukul975/Anthropic-Cybersecurity-Skills

    Deploy HashiCorp Vault for centralized secrets management, covering dynamic secret generation for databases and cloud providers, transit encryption, PKI certificate management, and Kubernetes…

    34k GitHub stars~3.2k tokensUpdated 1 mo ago
    DevOps & CloudAuto-check passed

  • Managing Secrets

    ancoleman/ai-design-components

    Managing secrets (API keys, database credentials, certificates) with Vault, cloud providers, and Kubernetes.

    526 GitHub stars~2.9k tokensUpdated 10 mo ago
    DevOps & CloudAuto-check passed

More from davila7/claude-code-templates

All 478 skills in this repo

  • Perplexity Web Search

    davila7/claude-code-templates

    Runs web-grounded searches through Perplexity's Sonar models over OpenRouter for current events, recent literature and cited facts beyond the model's training cutoff.

    32k GitHub starsUsed in 11 repos~3.5k tokens
    Auto-check: notes

  • Neuropixels Data Analysis

    davila7/claude-code-templates

    Analyzes Neuropixels recordings from SpikeGLX or Open Ephys through preprocessing, drift correction, Kilosort4 spike sorting, quality metrics and curation.

    32k GitHub starsUsed in 9 repos~2.8k tokens
    Auto-check passed

  • Scientific Venue Templates

    davila7/claude-code-templates

    Supplies LaTeX templates and formatting rules for journals, conferences, posters, and grant proposals, then can check a draft against them.

    32k GitHub starsUsed in 9 repos~5.1k tokens
    Auto-check: notes

  • Brand Voice Content Creator

    davila7/claude-code-templates

    Analyzes a brand's existing writing to lock in a consistent voice, then builds SEO blog posts and platform-specific social content around it.

    32k GitHub starsUsed in 3 repos~1.9k tokens
    Auto-check passed

  • CAPA Officer

    davila7/claude-code-templates

    Guides corrective and preventive action (CAPA) work in a quality management system, from initiation and root cause analysis through effectiveness verification.

    32k GitHub starsUsed in 1 repo~2k tokens
    Auto-check passed

  • Fda Consultant Specialist

    davila7/claude-code-templates

    Senior FDA consultant and specialist for medical device companies including HIPAA compliance and requirement management.

    32k GitHub starsUsed in 1 repo~2.7k tokens
    Auto-check passed

Works with

Categories

Questions about Secrets Management

What does Secrets Management do?

Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools. Secrets Management is an agent skill from davila7/claude-code-templates. Secure secrets management practices for CI/CD pipelines using Vault, AWS Secrets Manager, and other tools.

When should I use Secrets Management?

Secrets Management fits situations like: tasks that involve Secrets management; tasks that involve CI/CD.

How do I install Secrets Management in Claude Code?

Run `npx skills add davila7/claude-code-templates --skill secrets-management -a claude-code`. Or copy the skill folder (cli-tool/components/skills/security/secrets-management in davila7/claude-code-templates) into .claude/skills/secrets-management in your project. Claude Code loads it when a task matches its description.

How do I install Secrets Management in Codex?

Run `npx skills add davila7/claude-code-templates --skill secrets-management -a codex`. Or copy the skill folder (cli-tool/components/skills/security/secrets-management in davila7/claude-code-templates) into .agents/skills/secrets-management in your project. Codex loads it when a task matches its description.

Can I use Secrets Management in Cursor, Gemini CLI or GitHub Copilot?

Cursor, Gemini CLI, GitHub Copilot and OpenCode also load SKILL.md folders. With the skills CLI, run `npx skills add davila7/claude-code-templates --skill secrets-management -a cursor` (or -a gemini-cli, github-copilot or opencode for the others). To copy it by hand, put the folder in .cursor/skills/secrets-management, .gemini/skills/secrets-management, .github/skills/secrets-management and .opencode/skills/secrets-management in your project.

What does Secrets Management need to run?

Going by SKILL.md and its folder, Secrets Management needs the command-line tools its instructions call (vault, aws and docker) and credentials named DB_PASSWORD, API_KEY, VAULT_TOKEN and AWS_ACCESS_KEY_ID. Our summary lists: Python 3; Docker; A credential in VAULT_TOKEN; A credential in API_KEY.

Does Secrets Management access the network?

SKILL.md contains no URLs. Its commands use docker, which can reach the network depending on how they are called. This is read from the text; nothing was executed.

Is Secrets Management safe to install?

Our automated static check of SKILL.md found no risky patterns, such as piping downloads into a shell, reading credential files or hidden Unicode. It is not a guarantee. Review the folder before installing.

What licence does Secrets Management use?

Secrets Management is published under the MIT licence (the repository's licence). It allows redistribution, so the full SKILL.md is shown on this page.

How many tokens does Secrets Management use?

About 2k tokens (SKILL.md is roughly 8.1k characters). Agents keep only the skill's name and description in context until a task matches; then they load SKILL.md in full.

What are the alternatives to Secrets Management?

Skills that share tags, products or a category with Secrets Management: Phase 9 Deployment (ww-w-ai/bkit-claude-code, 601 stars), Hashicorp Vault (BagelHole/DevOps-Security-Agent-Skills, 1.1k stars), Secure GitHub Actions (vechain/x-app-template, 450 stars) and Secrets Vault Manager (alirezarezvani/claude-skills, 28k stars). The comparison table on this page puts their stars, adoption, token cost, safety result and licence side by side.

Who maintains Secrets Management?

davila7 (a GitHub user) maintains it in davila7/claude-code-templates, which has 32,483 GitHub stars. The repository holds 478 skills in this directory. The repository was last updated on October 9, 2026.

Source: davila7/claude-code-templates on GitHub. Facts on this page come from the repository at the commit we read; the author's words are quoted as theirs.