“secrets”的搜索结果

Comprehensive secrets extraction methodology targeting CI/CD environments across all major platforms. Covers environment variable extraction from build contexts, exploitation of vault and secrets-manager misconfigurations (HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager), runner and agent token abuse for lateral movement, OIDC federation attacks exploiting trust relationships between CI/CD providers and cloud platforms, build log leakage analysis for inadvertently exposed credentials, cache poisoning techniques for credential exfiltration, platform-specific credential store exploitation (GitHub Actions secrets, GitLab CI variables, Jenkins credential providers), service connection and service account abuse in Azure DevOps and GCP, and Docker registry credential theft from build environments. Maps to MITRE ATT&CK T1552 (Unsecured Credentials) and its sub-techniques. Each section provides enumeration procedures, extraction techniques, and post-exploitation pivoting guidance for usi...

中文简介正在准备中。当前显示原文说明。

将需要人工完成的服务设置或迁移流程整理为交互式bash脚本，分阶段引导界面操作、隐藏输入敏感信息，并将配置值保存到指定位置。

• 引导外部服务的设置流程
• 输入凭据并保存到.env
• 配置CI所需的GitHub机密

Set up Kubernetes deployments with ArgoCD or Flux CD using GitOps, an approach that stores the desired system configuration in Git. Configure automatic synchronization, staged rollouts, secret management, and deployment workflows across environments or clusters.

中文简介正在准备中。当前显示英语简介。

• Setting up automatic deployments from Git
• Managing deployments across multiple Kubernetes clusters
• Configuring canary or blue-green releases

Set up decoy credentials, storage, and secrets across AWS, Azure, and GCP to detect suspicious access. Connect audit logs to security alerts, verify detection, and document permissions, resource inventories, and maintenance plans.

中文简介正在准备中。当前显示英语简介。

• Detecting use of leaked cloud credentials
• Monitoring suspicious access to decoy storage and secrets
• Extending on-premises deception coverage to cloud environments

Analyze Kubernetes API server audit logs to identify pod access, secret reads, permission changes, privileged pods, and anonymous requests. Use the event patterns to reconstruct suspicious activity and develop detection rules for security monitoring systems.

中文简介正在准备中。当前显示英语简介。

• Tracing API activity during a suspected cluster compromise
• Reviewing access to Kubernetes secrets
• Investigating permission changes and privileged pods

Set up automated Android builds and Google Play publishing with GitHub Actions. Supports TWA, React Native, Flutter, and native Android, with signing setup, separate testing and production tracks, and automatic build-number increments on main.

中文简介正在准备中。当前显示英语简介。

• Setting up Google Play publishing from GitHub
• Separating internal, alpha, beta, and production releases
• Automating versionCode increments on main

Load API keys, tokens, and other secrets from Infisical into a shell or a specific command. The skill covers finding secret names, checking availability, and passing values to commands without displaying or logging them.

中文简介正在准备中。当前显示英语简介。

• Loading a missing API key before running a command
• Passing secrets only to the process that needs them
• Checking secret names and availability without displaying values

Guide secret synchronization between Infisical and a local encrypted vault, a store for sensitive values such as API keys. Covers authentication, reading and updating secrets, change tracking, and troubleshooting without exposing values in logs.

中文简介正在准备中。当前显示英语简介。

• Pulling Infisical secrets into a local encrypted vault
• Creating or updating secrets from local values
• Troubleshooting authentication and permission errors

Configure Convex deployment environment variables for secrets such as API keys, read them from application actions, and check the configured values while keeping secrets out of source code and Git.

中文简介正在准备中。当前显示英语简介。

• Setting API keys for a Convex deployment
• Reading secrets from actions
• Managing separate values for each deployment

Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up dedicated KMS encryption keys, automatic rotation, least-privilege IAM policies, CloudTrail auditing, and lifecycle management that are essential for production-grade secret handling.

中文简介正在准备中。当前显示原文说明。

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

中文简介正在准备中。当前显示原文说明。

Detect hardcoded sensitive data (API keys, access tokens, private keys, passwords, etc.) in publicly accessible code — frontend JavaScript, mobile apps, client-side bundles, and HTML templates. Uses a three-phase approach: recon (find secret candidates), batched verify (confirm real secrets in public code paths, 3 candidates each), and merge (consolidate batch results). Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/hardcodedsecrets-results.md. Use when asked to find hardcoded secrets, leaked API keys, or exposed credentials.

中文简介正在准备中。当前显示原文说明。

Store and rotate secrets in AWS Secrets Manager. Configure automatic rotation, access policies, and application integration. Use when managing secrets in AWS environments or requiring automatic credential rotation.

中文简介正在准备中。当前显示原文说明。

Manage environment variables and secrets across development, staging, and production environments. Use when someone needs to audit env vars, sync secrets between environments, detect missing or mismatched variables, rotate credentials, or set up a new environment from an existing one. Trigger words: env vars, environment variables, secrets, .env file, dotenv, config management, secret rotation, missing variable, environment sync.

中文简介正在准备中。当前显示原文说明。

Scan code for security vulnerabilities, misconfigurations, and exposed secrets. Use when a user asks to audit security, find vulnerabilities, check for OWASP issues, scan for secrets, review dependencies for CVEs, detect SQL injection, find XSS vulnerabilities, or harden an application. Covers OWASP Top 10, dependency auditing, secrets detection, and generates fix recommendations with severity ratings.

中文简介正在准备中。当前显示原文说明。

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

中文简介正在准备中。当前显示原文说明。

Azure Key Vault Secrets SDK for Rust. Use for storing and retrieving secrets, passwords, and API keys. Triggers: "keyvault secrets rust", "SecretClient rust", "get secret rust", "set secret rust".

中文简介正在准备中。当前显示原文说明。

处理OpenClaw的GitHub Secret Scanning警报，检查凭据泄露位置，遮盖正文中的机密信息，删除并重建评论，通知作者并完成警报处理。

• 查找凭据泄露的位置
• 遮盖Issue和PR正文中的机密信息
• 删除并重建含有机密信息的评论

为 Quarkus 应用实现并检查身份认证、访问权限和输入验证，同时涵盖机密信息管理、密码哈希、请求限制、审计日志及依赖项已知漏洞检查。

• 为 Quarkus API 添加 JWT 或 OIDC 认证
• 检查角色权限与数据归属验证
• 审查输入验证与数据库查询

Find agent skills on GitHub, score their relevance using rule-based checks, scan for malware and embedded secrets, and import them into supported agent directories, including Hermes, Claude Code, Gemini CLI, and OpenCode.

中文简介正在准备中。当前显示英语简介。

• Find community skills for a specific task
• Compare skills using relevance scores
• Check for malware and embedded secrets