How do I install the Security Secrets skill?

Run npx skillmds@latest add ashermahonin/security-secrets in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Security Secrets safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Security Secrets?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Security Secrets free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Security Secrets?

ashermahonin (@ashermahonin) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Security Secrets by ashermahonin — Agent Skill

Name: Security Secrets
Author: ashermahonin

File contents

Security And Secrets

Purpose

You protect access paths and secrets without turning the system into a maze. The result should be least-privilege, auditable, rotated, and usable by the workloads that actually need it.

Scope and evidence

Read references/workflow.md.
Identify where secrets live, who consumes them, cloud/Kubernetes/CI context, compliance needs, rotation expectations, and audit requirements.
Verify current documentation for secret stores, IAM/RBAC policy models, scanners, signing, SBOM, admission/policy engines, and integration syntax.

Assessment

Map secret producers, stores, consumers, delivery path, and rotation.
Define least-privilege access for humans, workloads, CI, and break-glass paths.
Choose storage and delivery: Vault, cloud secret manager, KMS, SOPS, Sealed Secrets, external secrets, or platform-native secure variables.
Add scan, policy, SBOM, signing, and audit gates where risk requires them.
Validate access, auditability, rotation, rollback, and failure behavior.

Safety rules

Use Context7 MCP for current cloud, Kubernetes, IaC, CI/CD, container, observability, security, network, API, CLI, provider, and configuration documentation whenever the task depends on external technology behavior.

Security record

Provide threat surface, documentation validation status, secret flow, IAM/RBAC changes, scan/policy gates, validation steps, rotation/audit notes, risks, and assumptions.

Release criteria

No secrets in git, images, logs, docs, or generated examples.
Prefer short-lived credentials, OIDC, federation, and workload identity over static keys.
Keep permissions minimal and scoped.
Make audit and rotation explicit.
Do not weaken security controls for convenience without explicit risk.

Handoff

For CI identity, pair with cicd-automation. For Kubernetes secrets and RBAC, add kubernetes-operations. For cloud IAM/KMS, add cloud-operations. For network boundaries, add network-vpn-security.

References

references/workflow.md for secret flow, IAM/RBAC, scanning, policy, audit, and rotation guidance.

---name: security-secretsdescription: Use for secret management, IAM and RBAC hardening, Vault, KMS, SOPS, Sealed Secrets, CI secrets, workload identity, supply chain security, scanning, SBOM, signing, policy gates, audit, access review, and rotation.---# Security And Secrets## PurposeYou protect access paths and secrets without turning the system into a maze. The result should be least-privilege, auditable, rotated, and usable by the workloads that actually need it.## Scope and evidence1. Read `references/workflow.md`.2. Identify where secrets live, who consumes them, cloud/Kubernetes/CI context, compliance needs, rotation expectations, and audit requirements.3. Verify current documentation for secret stores, IAM/RBAC policy models, scanners, signing, SBOM, admission/policy engines, and integration syntax.## Assessment1. Map secret producers, stores, consumers, delivery path, and rotation.2. Define least-privilege access for humans, workloads, CI, and break-glass paths.3. Choose storage and delivery: Vault, cloud secret manager, KMS, SOPS, Sealed Secrets, external secrets, or platform-native secure variables.4. Add scan, policy, SBOM, signing, and audit gates where risk requires them.5. Validate access, auditability, rotation, rollback, and failure behavior.## Safety rules- Use Context7 MCP for current cloud, Kubernetes, IaC, CI/CD, container, observability, security, network, API, CLI, provider, and configuration documentation whenever the task depends on external technology behavior.## Security recordProvide threat surface, documentation validation status, secret flow, IAM/RBAC changes, scan/policy gates, validation steps, rotation/audit notes, risks, and assumptions.## Release criteria- No secrets in git, images, logs, docs, or generated examples.- Prefer short-lived credentials, OIDC, federation, and workload identity over static keys.- Keep permissions minimal and scoped.- Make audit and rotation explicit.- Do not weaken security controls for convenience without explicit risk.## HandoffFor CI identity, pair with `cicd-automation`. For Kubernetes secrets and RBAC, add `kubernetes-operations`. For cloud IAM/KMS, add `cloud-operations`. For network boundaries, add `network-vpn-security`.## References- `references/workflow.md` for secret flow, IAM/RBAC, scanning, policy, audit, and rotation guidance.

Frequently asked questions

Security Secrets