Results for “dynamic-secrets”

Detects fail-open insecure defaults (hardcoded secrets, weak auth, permissive security) that allow apps to run insecurely in production. Use when auditing security, reviewing config management, or analyzing environment variable handling.

Env & Secrets Manager

Audit environment-variable hygiene and secrets safety across local development and production with practical scanning, drift awareness, and rotation readiness.

Skills system architecture — progressive disclosure, frontmatter, platform filtering, self-editing

Persists app data on Android using Room, SQLite, SharedPreferences, DataStore, and encryption.

Use this skill for secret inventory, env vars, rotation plans, safe dev/prod separation, leak response. Trigger when the task involves security work related to Secrets Env Rotation, implementation, audits, debugging, strategy, or validation.

Configure and manage GitHub secret scanning, push protection, custom patterns, and alert remediation.

Generates CI/CD pipeline configurations for Adobe App Builder projects, including GitHub Actions workflows, Azure DevOps, and GitLab CI templates with OAuth S2S secrets injection and multi-workspace promotion.

Store, retrieve, and automatically rotate credentials, API keys, and other secrets using AWS Secrets Manager.

Env & Secrets Manager

Manages automated dynamic/trailing stop losses (DSL only) for leveraged perpetual positions on Hyperliquid. Default mode: High Water (pct_of_high_water) — the trailing floor is a percentage of the peak ROE, recalculated every tick, no ceiling. Also supports fixed ROE tiers for legacy positions. Monitors price via cron, ratchets profit floors through configurable tiers, syncs the stop loss to Hyperliquid via edit_position, and auto-closes positions on breach via mcporter. Supports LONG and SHORT, strategy-scoped state isolation, and automatic cleanup.

Hunt for DNS-based persistence mechanisms including DNS hijacking, dangling CNAME records, wildcard DNS abuse, and unauthorized zone modifications using passive DNS databases, SecurityTrails API, and DNS audit log analysis.

Local-first secret scanning for repos and git history. Use before every push, when scanning for exposed keys, checking for committed credentials, or auditing a repo for accidental secret leaks. Designed for Nick's workflow and safer than forcing suspicious marketplace secret scanners.

Provides a comprehensive security checklist and code patterns for authentication, input validation, secrets management, SQL injection prevention, XSS, CSRF, rate limiting, and sensitive data exposure.

Detect and prevent hardcoded secrets in git repositories using Gitleaks, including pre-commit hooks, CI/CD integration, custom rules, baseline management, and remediation workflows.

Expert guidance for architecting, developing, and operating SurrealDB 3, covering SurrealQL, multi-model data modeling, vector search, security, deployment, performance tuning, SDK integration, and ecosystem tools.

Extract Active Directory credentials via DCSync attacks and establish domain persistence by dumping KRBTGT, Domain Admin, and service account hashes for Golden Ticket creation.

Implements security-sensitive changes with conservative trust boundaries, secret protection, tests, and verification.

Design DNS security strategies. TRIGGERS - Use when user needs help with dns-security related tasks.

Design DNS security strategies. TRIGGERS - Use when user needs help with dns-security related tasks.

Automate credential rotation for service accounts across Active Directory, cloud platforms, and application databases to eliminate stale secrets and reduce compromise risk.

Manage a HashiCorp Vault PKI secrets engine to act as a certificate authority, issuing and rotating short-lived X.509 certificates for services and microservices.

Save the current diagnosis state to disk for cross-session recall, including conclusions, rejected directions, and next steps.

Agent Vault — fetching secrets from Infisical at runtime

Drive mex (`mex-agent`), persistent project memory and code graphs for AI coding agents. One command scaffolds a living wiki, builds a deterministic code graph, and installs a project anchor file (CLAUDE.md, root AGENTS.md, .cursorrules, .windsurfrules, copilot-instructions.md, or .opencode/opencode.json) that your agent auto-loads as a standing rule document. Use when the user wants to `mex setup` a new project, build a symbol-grounded wiki, keep knowledge connected to implementation, route relevant context to agents, or run drift detection (`mex check`, `mex sync`). Triggers on: "mex setup", "project memory", "code graphs", "codebase documentation", "drift detection", "agent memory", "structured scaffolds", "architectural context", "living wiki", "project anchor file".

Use when developing in packages/agent-core-v2 (the DI × Scope agent engine) — adding or modifying a domain Service, choosing a LifecycleScope, wiring DI dependencies, splitting a domain across scopes, owning or migrating a config section, gating behavior behind an experimental flag, raising coded errors, working on the permission system, writing DI/Scope tests, porting business logic from agent-core (v1) to v2, triaging a main-branch commit against v2, or exposing a v2 domain over server-v2 while keeping the /api/v1 wire contract compatible with released clients. Self-contained guide organized by development stage (orient → design → implement → test → verify) plus align workflows for v1→v2 migration, main-branch commit triage, and server-v2 wire exposure; each file carries the rules, examples, and red lines for its step.

Integrate gitleaks and trufflehog into CI/CD pipelines to detect leaked secrets before deployment.

Reviews secrets, config defaults, environment variables, logs, credentials, CI secrets, and unsafe settings.

Anti-distillation defense for employee Skills. Clean your skill files to look complete but with core proprietary knowledge neutralized. Use when user wants to protect trade secrets, sanitize forced knowledge transfers, or create safe-to-submit skill documents.

Audit the working tree and git history for exposed credentials and mis-scoped keys, then a rotate-vs-relocate plan. Use when "hardcoded secrets", "did I commit a key", "secret scan", "is my .env safe", or "rotate keys". Do not fire for "RLS audit" or generic "security burndown".

Scan text or a file for accidentally committed secrets (API keys, tokens)

建议在逻辑间隔处手动压缩上下文，以在任务阶段中保留上下文，而非任意的自动压缩。

Manages a personal operating system for content creation, relationship management, goal tracking, and weekly reviews using progressive disclosure and append-only data files.

Manage environment variables and secrets securely in Claude Code sessions, ensuring sensitive values are never exposed in logs, diffs, or context.