# Infisical CLI Secrets

> Use Infisical CLI cleanly for secrets, env injection, machine identity auth, self-hosted domains, and repo-specific secret workflows. Trigger when the user mentions Infisical, infisical CLI, universal-auth, machine identity, secret injection, replacing .env files, or using secrets for Pawrrtal/dev services.

- Skill: `octaviantocan/infisical-cli-secrets` (Agent Skill, multi-file: 5 files)
- Install (CLI): `npx skillmds@latest add octaviantocan/infisical-cli-secrets`
- Raw SKILL.md: https://api.skillmd.com/api/skills/octaviantocan/infisical-cli-secrets/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: octaviantocan (https://skillmd.com/u/octaviantocan)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/octaviantocan/infisical-cli-secrets

---


# Infisical CLI Secrets

Use the Infisical CLI as the source-of-truth boundary for secrets: authenticate safely, inject secrets into processes with `infisical run`, and avoid copying values into chat, logs, or tracked files. Prefer process-time injection and project-native secret surfaces over hand-written `.env` files.

## Variables

- **INFISICAL_DOMAIN**: self-hosted or cloud domain, for example `https://infisical.example.internal`.
- **INFISICAL_PROJECT_ID**: Infisical project UUID.
- **INFISICAL_ENV**: environment slug, usually `dev`, `staging`, or `prod`.
- **INFISICAL_MACHINE_ENV_FILE**: optional local env file containing `INFISICAL_CLIENT_ID`, `INFISICAL_CLIENT_SECRET`, `INFISICAL_DOMAIN`, and `INFISICAL_PROJECT_ID`.
- **PAWRRTAL_REPO**: optional Pawrrtal checkout path when applying the Pawrrtal cookbook.

## How It Works

First classify the secret surface: local dev process, service process, CI, or application-owned workspace/user secrets. Then authenticate with user login or machine identity, run the smallest safe smoke, and inject secrets at the process boundary with `infisical run` unless the target application has its own encrypted secret store.

## Commands

| Command | Purpose |
| --- | --- |
| `/infisical-cli-secrets recon` | Inspect a repo and decide how secrets should flow. |
| `/infisical-cli-secrets auth` | Authenticate safely with user login or machine identity. |
| `/infisical-cli-secrets run` | Wrap a command with Infisical secret injection. |
| `/infisical-cli-secrets sync` | Add, update, or audit secret keys without leaking values. |
| `/infisical-cli-secrets pawrrtal` | Apply the clean pattern to Pawrrtal gateway and workspace secrets. |

## Cookbook

Each command has a detailed step-by-step guide. **Read the relevant cookbook file before executing a command.**

| Command | Cookbook | Use When |
| --- | --- | --- |
| recon | [cookbook/recon.md](cookbook/recon.md) | You need to understand a repo's env files, config, and secret planes. |
| auth | [cookbook/auth.md](cookbook/auth.md) | You need a safe CLI session or machine token. |
| run | [cookbook/run.md](cookbook/run.md) | You need to start a command with secrets injected. |
| sync | [cookbook/sync.md](cookbook/sync.md) | You need to set, import, compare, or verify secret keys. |
| pawrrtal | [cookbook/pawrrtal.md](cookbook/pawrrtal.md) | The repo is Pawrrtal or uses its `paw`/workspace-env conventions. |

**When a user invokes `/infisical-cli-secrets`, read the matching cookbook file first, then execute the steps.**

## Safety Rules

1. Never print secret values. Avoid `infisical secrets --plain`, `infisical export`, or `printenv` unless the output is redirected to a protected file and the user explicitly requested that.
2. Prefer `infisical run -- <command>` over writing `.env`. Use a file only when the target tool cannot accept process env, and set `0600` permissions.
3. For self-hosted instances, pass `--domain` on every command or export `INFISICAL_API_URL`/`INFISICAL_DOMAIN`.
4. For machine identities, capture the token into `INFISICAL_TOKEN`; do not pass tokens directly in command strings or store them in tracked files.
5. Treat deletes as high-risk. Confirm intent, verify the key name and environment, and prefer UI/API deletion if the installed CLI delete path is known broken.

## Related Skills

**Works with:** `/tailscale`, `/dev-box`, `/deploy-checklist`