# Secrets Vault Manager

> Handle SOPS + Age secrets for ONE_SHOT projects. Manages encrypted secrets, decryption, and secret rotation. Use when user mentions 'secrets', 'API keys', 'environment variables', '.env', or 'SOPS'.

- Skill: `majiayu000/secrets-vault-manager` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add majiayu000/secrets-vault-manager`
- Raw SKILL.md: https://api.skillmd.com/api/skills/majiayu000/secrets-vault-manager/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: majiayu000 (https://skillmd.com/u/majiayu000)
- Updated: 2026-09-09
- Page: https://skillmd.com/skills/majiayu000/secrets-vault-manager

---


# Secrets Vault Manager

You are an expert at managing secrets with SOPS + Age encryption.

## When To Use

- Project needs API keys / secrets
- User mentions "Set up secrets-vault"
- User asks to "Decrypt / refresh secrets"
- User wants to "Add a new secret"

## Philosophy

One Age key in 1Password → ALL secrets.

## Setup (One-Time)

```bash
# Install
sudo apt install age sops  # Ubuntu
brew install age sops      # Mac

# Generate key
mkdir -p ~/.age
age-keygen -o ~/.age/key.txt
# Save public key (age1...) to 1Password

# Secrets are in the oneshot repo
# If not cloned: git clone git@github.com:Khamel83/oneshot.git ~/github/oneshot
```

## Create .sops.yaml

```yaml
creation_rules:
  - path_regex: .*\.encrypted$
    age: 'age1your_public_key_here'
```

## Daily Usage

```bash
# Decrypt to project
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
source .env

# Update secrets
sops ~/github/oneshot/secrets/secrets.env.encrypted
# Edit, save, auto-encrypted
cd ~/github/oneshot && git add . && git commit -m "Update secrets" && git push
```

## Common Operations

### Decrypt for Local Use

```bash
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
```

Verify `.env` is gitignored!

### Add New Secret

```bash
sops ~/github/oneshot/secrets/secrets.env.encrypted
# Add: NEW_SECRET=value
# Save and exit
cd ~/github/oneshot && git add . && git commit -m "Add NEW_SECRET" && git push
```

### Refresh Secrets

```bash
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
```

### Per-Project SOPS (Alternative)

If not using central vault:

```bash
mkdir -p .sops
age-keygen -o .sops/key.txt

cat > .sops.yaml << 'EOF'
creation_rules:
  - path_regex: \.encrypted$
    age: 'age1your_key'
EOF

sops secrets.env.encrypted
sops --decrypt secrets.env.encrypted > .env
```

## .gitignore Template

```gitignore
# Secrets (NEVER commit)
.env
.env.local
secrets.env
*.key
key.txt
.age/

# Allow examples
!.env.example

# SOPS encrypted ARE safe
!*.encrypted
```

## Document in README

Add to project README:

```markdown
## Secrets

This project uses SOPS + Age for secrets management.

\`\`\`bash
# Decrypt secrets (requires Age key)
sops --decrypt ~/github/oneshot/secrets/secrets.env.encrypted > .env
source .env
\`\`\`
```

## Outputs

- `.env` created or refreshed (gitignored)
- Documentation updated: README "Secrets" section
- `secrets.env.encrypted` updated in vault when adding new secrets

## Anti-Patterns

- Ever committing `.env` or raw secrets
- Decrypting into tracked files
- Sharing Age private key outside 1Password
- Storing secrets in code or comments

## Related Skills

- `secrets-sync`: Two-way sync between vault and projects, namespacing, project labels

## Keywords

secrets, API keys, environment variables, .env, SOPS, Age, encrypt, decrypt, vault