Results for “secrets”

Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for usi...

The English summary is being prepared. Showing the original description.

Create an interactive bash script for setup or migration steps that require a person. It guides dashboard actions, captures values, saves configuration and GitHub secrets, and requests confirmation at each stage.

• Guided setup of third-party services
• Entering credentials and saving them to .env
• Configuring GitHub secrets for CI

Set up Kubernetes deployments with ArgoCD or Flux CD using GitOps, an approach that stores the desired system configuration in Git. Configure automatic synchronization, staged rollouts, secret management, and deployment workflows across environments or clusters.

• Setting up automatic deployments from Git
• Managing deployments across multiple Kubernetes clusters
• Configuring canary or blue-green releases

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Set up automated Android builds and Google Play publishing with GitHub Actions. Supports TWA, React Native, Flutter, and native Android, with signing setup, separate testing and production tracks, and automatic build-number increments on main.

• Setting up Google Play publishing from GitHub
• Separating internal, alpha, beta, and production releases
• Automating versionCode increments on main

Load API keys, tokens, and other secrets from Infisical into a shell or a specific command. The skill covers finding secret names, checking availability, and passing values to commands without displaying or logging them.

• Loading a missing API key before running a command
• Passing secrets only to the process that needs them
• Checking secret names and availability without displaying values

Guide secret synchronization between Infisical and a local encrypted vault, a store for sensitive values such as API keys. Covers authentication, reading and updating secrets, change tracking, and troubleshooting without exposing values in logs.

• Pulling Infisical secrets into a local encrypted vault
• Creating or updating secrets from local values
• Troubleshooting authentication and permission errors

Configure Convex deployment environment variables for secrets such as API keys, read them from application actions, and check the configured values while keeping secrets out of source code and Git.

• Setting API keys for a Convex deployment
• Reading secrets from actions
• Managing separate values for each deployment

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

The English summary is being prepared. Showing the original description.

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

The English summary is being prepared. Showing the original description.

Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/hardcodedsecrets-results.md. Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials.

The English summary is being prepared. Showing the original description.

Store and rotate secrets in AWS Secrets Manager. Configure automatic rotation, access policies, and application integration. Use when managing secrets in AWS environments or requiring automatic credential rotation.

The English summary is being prepared. Showing the original description.

Manage environment variables and secrets across development, staging, and production environments. Use when someone needs to audit env vars, sync secrets between environments, detect missing or mismatched variables, rotate credentials, or set up a new environment from an existing one. Trigger words: env vars, environment variables, secrets, .env file, dotenv, config management, secret rotation, missing variable, environment sync.

The English summary is being prepared. Showing the original description.

Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.

The English summary is being prepared. Showing the original description.

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

The English summary is being prepared. Showing the original description.

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

The English summary is being prepared. Showing the original description.

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

The English summary is being prepared. Showing the original description.

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

The English summary is being prepared. Showing the original description.

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

The English summary is being prepared. Showing the original description.

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

The English summary is being prepared. Showing the original description.

Process OpenClaw GitHub Secret Scanning alerts, which flag exposed credentials. Inspect affected content, redact secrets, replace comments when needed, notify authors, and resolve alerts using a dedicated script under maintainer permissions.

• Investigating locations flagged for exposed credentials
• Redacting secrets in issue or pull request descriptions
• Deleting and recreating comments containing secrets

Implement and review security measures in Quarkus applications. Covers sign-in, access permissions, input validation, password hashing, secret storage, request limits, audit logs, and checks for known vulnerabilities in dependencies, with implementation and configuration examples.

• Adding JWT or OIDC authentication to a Quarkus API
• Checking role permissions and resource ownership
• Reviewing input validation and database queries

Find agent skills on GitHub, score their relevance using rule-based checks, scan for malware and embedded secrets, and import them into supported agent directories, including Hermes, Claude Code, Gemini CLI, and OpenCode.

• Find community skills for a specific task
• Compare skills using relevance scores
• Check for malware and embedded secrets