Agent skill · personamanagmentlayer
secrets-management-expert
Store, distribute, rotate and revoke credentials without ever placing them in source: vaults, cloud secret managers, KMS envelope encryption and dynamic credentials. Use when the user mentions secrets, API keys, credentials, HashiCorp Vault, KMS, key rotation, a leaked or committed secret, .env files, sealed secrets, or when the task involves getting a password out of code, encrypting data at rest, or responding to an exposure.
What it needs
About 6k tokens when loaded.
What this skill does
Secrets Management Expert A secret in source control is compromised the moment it is pushed, and it stays compromised after deletion because history is forever. Everything below follows from that. Core Concepts The Hierarchy Ranked by how much damage a compromise causes: 1. No secret at all — workload identity. The platform proves who the workload is; no credential exists to steal. The target state wherever it is available. 2. Dynamic, short-lived credentials — minted per session, expiring in minutes. Theft has a short window. 3. Static secret in a manager, rotated on a schedule, accessed by authenticated identity, audited. 4. Static secret in an environment variable, injected at deploy. 5. Secret in a config file on disk. 6. Secret in source control. Compromised. Move each secret up this list rather than aiming for perfection everywhere. Envelope Encryption Encrypt data with a data key; encrypt the data key with a key that never leaves the KMS. Store the wrapped data key beside the ciphertext. This is what lets you rotate the master key without re-encrypting terabytes, and what keeps the master key material inside a boundary you can audit. Rotation Only Works If It Is Routine A rotation procedure exercised once a year fails when you need it during an incident. Rotate on a schedule so the mechanism is known to work — that, not the interval, is the point. Getting Secrets Out of Code Validate every required secret at startup, not at first use. A service that boots successfully and fails at 3 a.m. on the first payment is worse than one that refuses to start. Never log them, never put them in error messages, and never pass them as command line arguments — the process table is world-readable. This stops the common leak: an exception rendering a config object, or a structured logger serialising a settings dataclass. Secret Managers HashiCorp Vault Dynamic secrets are the reason to run Vault. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills personamanagmentlayer/secrets-management-expert