infisical

@infisical source repo

18 skills
0 followers
18 hours ago last updated

▌
Design · infisical
Elegant design-system skill — foundations (typography, color, spacing), component families, accessibility (WCAG 2.2 AA), and a structured workflow for authoring implementation-ready UI guidance. Use when designing or specifying Elegant UI, tokens, components, or design-system rules and QA checklists.

0
installs
▌
Infisical Kms · infisical bundle
Guide for Infisical KMS — managing cryptographic keys and performing encrypt/decrypt, sign/verify, and HMAC operations without the key ever leaving the platform. Covers KMS key creation with the three key usages (encrypt-decrypt, sign-verify, generate-verify-mac), symmetric algorithms (aes-256-gcm, aes-128-gcm), asymmetric algorithms (RSA_4096, ECC_NIST_P256/P384/P521, post-quantum ML_DSA_44/65/87), signing algorithms (RSASSA_PSS, RSASSA_PKCS1_V1_5, ECDSA, ML-DSA), HMAC algorithms, key rotation, exportable keys, external KMS backing with AWS KMS or GCP KMS, KMIP server integration, Kubernetes encryption-at-rest, and Sigstore cosign signing. Use this skill when someone asks about: Infisical KMS, encrypting data with a managed key, envelope encryption, sign and verify with Infisical, HMAC, KMIP, external KMS, or 'how do I encrypt data without handling the key'. For doing cryptography with a key Infisical never releases. Not for storing a value and reading it back, which is a secret (infisical-setup), nor for X.

1
install
▌
Infisical Pam · infisical bundle
Guide for Infisical Privileged Access Manager (PAM) — brokering human and AI-agent access to databases, servers, Kubernetes clusters, and cloud accounts without the connecting party ever seeing a credential, with full session recording and audit. Covers all 13 account types (SSH, PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, Kubernetes, AWS IAM, GCP service account, Azure CLI, Windows, Windows AD), the accounts/folders/templates/memberships model, Admin/Connector/Auditor roles, session lifecycle and recording, just-in-time access requests with approvals, account credential rotation, discovery, dependencies, web and CLI access, and agentic access for AI agents via `infisical pam agentic access`. Use this skill when someone asks about: Infisical PAM, privileged access, session recording, just-in-time database access, brokered SSH access, giving an AI agent database access safely, access requests and approvals for infrastructure, or 'how do I let someone into production without giving them the password'. F

1
install
▌
Infisical Pki · infisical bundle
Guide for Infisical Certificate Management (PKI) — issuing, renewing, revoking, and distributing X.509 certificates. Covers all 9 certificate authority types (internal root/intermediate CA, ACME including Let's Encrypt, AWS Private CA, AWS ACM Public CA, Microsoft ADCS, Azure ADCS, DigiCert, Venafi TPP, GoDaddy), Applications and Certificate Profiles, all 4 enrollment methods (API, ACME, EST, SCEP), all 12 PKI Syncs for pushing certs to AWS ACM / Azure Key Vault / Cloudflare / load balancers, certificate lifecycle and alerting, code signing with PKCS#11 and Windows KSP, certificate discovery, HSM connectors, CRL distribution, and post-quantum ML-DSA and SLH-DSA key algorithms. Use this skill when someone asks about: Infisical PKI, certificate authority, issuing a TLS certificate, mTLS certificates, ACME or Let's Encrypt with Infisical, EST or SCEP enrollment, certificate renewal, revocation, CRL, code signing certificates, or 'how do I manage certificates with Infisical'. For X.509/TLS certificates and code s

1
install
▌
Infisical Sso · infisical bundle
Guide for connecting Infisical to an identity provider for human login and user provisioning. Covers Google and GitHub SSO (free), SAML 2.0 and OIDC (paid) with Okta, Azure/Entra ID, JumpCloud, Google, Auth0, Keycloak, PingOne, GitLab, LDAP login, SCIM user and group provisioning with Okta/Azure/JumpCloud/PingOne/PingFederate, SAML and OIDC group membership mapping, SCIM group to organization role mappings, the mandatory email domain verification prerequisite, SSO enforcement and its effect on password signup, and the /login/admin break-glass portal. Use this skill when someone asks about: Infisical SSO, SAML login, OIDC login, Okta or Azure AD integration, SCIM provisioning, syncing identity provider groups into Infisical, enforcing SSO, or being locked out after enabling SSO. For HUMAN login and user provisioning. Not for machine identity auth methods, including OIDC and LDAP for workloads (infisical-setup), nor for roles and permissions (infisical-access-control).

1
install
▌
Infisical Agent · infisical bundle
Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor `infisical run` (infisical-setup).

1
install
▌
Infisical User Setup Guide · infisical bundle
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets outward (infisical-secret-

1
install
▌
Infisical Gateway · infisical bundle
Guide for the Infisical Gateway and Relay — reaching private network resources (VPC-only databases, on-premises directories, internal APIs, HSMs) from Infisical without any inbound firewall rules. Covers the gateway/relay architecture using SSH reverse tunnels, exact ports and egress allowlist requirements (TCP 2222 to the relay, TCP 443 to Infisical, TCP 8443 platform-to-relay), deployment with `infisical gateway start` and `infisical gateway systemd`, Infisical-managed vs self-deployed relays, Gateway Pools for high availability, health checks and heartbeat intervals, and which features and App Connection types can be routed through a gateway. Use this skill when someone asks about: Infisical Gateway, relay server, accessing a private database from Infisical, dynamic secrets for a database with no public endpoint, gateway pools, or 'Infisical cannot reach my internal resource'. A Gateway is not a substitute for self-hosting (infisical-self-host) and not an App Connection (infisical-app-connections) — privat

1
install
▌
Infisical Self Host · infisical bundle
Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTION_KEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).

1
install
▌
Infisical Terraform · infisical bundle
Expert guidance for the Infisical Terraform Provider. Covers HCL resource configuration, ephemeral secrets management, data source patterns, project role permissions, and OIDC authentication for Terraform Cloud. Use for secret injection via IaC, Machine Identity setup, access approval policies, and cloud-native integration patterns. Not for getting secrets into a running app (infisical-setup) or raw REST calls (infisical-api).

1
install
▌
Infisical Secret Syncs · infisical bundle
Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers all 48 sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, Snowflake, Databricks, Railway, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, initial sync behavior, or 'how do I get my Infisical secrets into [service]'. Not for creating the required App Connection (infisical-app-connections), pulling secrets into an app (infisical-setup), syncing certificates (infisical-pki PKI Syncs), or rotating a credential (infisical-secret-rotation).

1
install
▌
Infisical Access Control · infisical bundle
Guide for Infisical access control and governance — org and project roles, custom roles with subject/action permissions, granular secret permissions that separate describing a secret from reading its value, attribute-based access control (ABAC) driven by user metadata and machine identity attributes, additional privileges, assume-privilege, temporary (time-bound) access, access requests, change-approval and access-approval policies, and audit logs including streaming to Splunk, Datadog, Azure, Cribl, Sumo Logic, or a custom webhook. Use this skill when someone asks about: Infisical roles and permissions, custom roles, least privilege for secrets, letting someone see a secret exists without reading it, ABAC, temporary access, approval workflows for secret changes, access requests, audit logs, or streaming audit events to a SIEM. For what a principal can do once inside. Not for connecting an identity provider for login or SCIM (infisical-sso), nor for machine identity auth methods (infisical-setup).

1
install
▌
Infisical App Connections · infisical bundle
Guide for creating and managing Infisical App Connections — the reusable authenticated links between Infisical and third-party services that Secret Syncs, Secret Rotations, PKI certificate authorities, PKI Syncs, and Secret Scanning data sources all depend on. Covers all 83 connection types and their exact auth methods (AWS assume-role vs access-key, GitHub OAuth vs GitHub App vs PAT, Azure OAuth vs client-secret vs certificate, GCP service account impersonation, and more), platform-managed credentials, Gateway-routed connections for private networks, and connection-level credential rotation. Use this skill when someone asks about: App Connections, connecting Infisical to AWS/GCP/Azure/GitHub, 'connection not found' when creating a sync, which auth method a connection needs, reusing a connection across syncs, or 'how do I authenticate Infisical to a third-party service'. This is Infisical authenticating OUTWARD to a third party. Not for machine identities, which are workloads authenticating INTO Infisical (in

1
install
▌
Infisical Dynamic Secrets · infisical bundle
Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers all 30 providers including PostgreSQL, MySQL, MSSQL, Oracle, Redis, AWS ElastiCache, AWS MemoryDB, MongoDB, Elasticsearch, Couchbase, Milvus, AWS IAM, GCP IAM, Azure Entra ID, SSH certificates, Kubernetes service accounts, LDAP, GitHub, Tailscale, IBM API Connect, and TOTP. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, lease renewal, or 'how do I generate temporary credentials with Infisical'. For brand-new short-lived credentials created per request. Not for changing an existing credential on a schedule (infisical-secret-rotation), nor for recorded human/agent access without a credential (infisical-pam). Covers SSH certificates; TLS certificates are infisical-pki.

1
install
▌
Infisical Secret Rotation · infisical bundle
Guide for configuring Infisical Secret Rotation — automatically rotating credentials that already exist in a third-party system on a fixed interval, writing the new values back into Infisical secrets. Covers all 28 rotation providers (PostgreSQL, MySQL, MSSQL, OracleDB, MongoDB, Redis, AWS IAM user secrets, Azure/Okta/Auth0 client secrets, LDAP passwords, Unix/Linux and Windows local accounts, Cloudflare, Datadog, Snowflake key pairs, OpenAI/OpenRouter/LiteLLM/Fireworks API keys, and more), the dual-phase vs single-phase rotation models, rotation intervals and rotateAtUtc scheduling, parameters and secretsMapping, and the two-user pattern for SQL databases. Use this skill when someone asks about: secret rotation, rotating credentials, automatic credential rotation, rotating a database password on a schedule, expiring API keys, rotationInterval, or 'how do I rotate my database password automatically'. For changing an EXISTING credential on a timer. Not for creating brand-new ephemeral credentials per request (

1
install
▌
Infisical Secret Scanning · infisical bundle
Guide for Infisical Secret Scanning — detecting leaked credentials in source code and developer systems. Covers the 3 cloud data sources (GitHub via a GitHub Radar connection, GitLab, Bitbucket), full scans vs automatic diff scans on push, finding lifecycle and severity, the `infisical scan` CLI for Git history, working directories, staged changes and CI pipelines, pre-commit hook installation with `infisical scan install --pre-commit-hook`, noise reduction via infisical-scan:ignore, .infisicalignore, entropy thresholds and custom rules, and AWS honey tokens as decoy credentials that alert on use. Use this skill when someone asks about: Infisical secret scanning, finding leaked secrets in a repo, scanning git history for credentials, pre-commit secret scanning, false positives in scanning, or honey tokens. Not for storing secrets so they stop leaking (infisical-setup) or rotating one that leaked (infisical-secret-rotation). GitHub scanning needs a github-radar App Connection, not a github one.

1
install
▌
Infisical Kubernetes Operator · infisical bundle
Guide for the Infisical Kubernetes Operator — syncing secrets from Infisical into Kubernetes Secrets and ConfigMaps, pushing secrets from Kubernetes to Infisical, and managing dynamic secret leases in-cluster. Covers the v1beta1 CRDs (InfisicalConnection, InfisicalAuth, InfisicalStaticSecret) and the legacy v1alpha1 CRDs (InfisicalSecret, InfisicalDynamicSecret, InfisicalPushSecret), Helm installation cluster-wide or namespace-scoped, all 7 operator auth methods, sources and targets, creationPolicy Owner vs Orphan, refreshInterval, the secrets.infisical.com/auto-reload annotation for automatic Deployment rollouts, and Go templating of rendered secrets. Use this skill when someone asks about: Infisical Kubernetes Operator, InfisicalSecret CRD, InfisicalStaticSecret, syncing Infisical secrets into a Kubernetes Secret, auto-reloading pods on secret change, pushing Kubernetes secrets to Infisical, or 'how do I get Infisical secrets into my Kubernetes cluster'. Not for self-hosting Infisical on Kubernetes (infisic

1
install
▌
Infisical API · infisical bundle
Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).

1
install

18 published skills