Agent skill · security · sundial-org
api-credentials-hygiene
Audits and hardens API credential handling (env vars, separation, rotation plan, least privilege, auditability). Use when integrating services or preparing production deployments where secrets must be managed safely.
Why this skill is useful
Provides a detailed rotation plan and least-privilege checklist that the AI wouldn't reliably generate on its own.
What it needs
About 2k tokens when loaded. Last updated 2026-03-07. 639 stars on the source repository.
What this skill does
API credentials hygiene: env vars, rotation, least privilege, auditability PURPOSE Audits and hardens API credential handling (env vars, separation, rotation plan, least privilege, auditability). WHEN TO USE TRIGGERS: Harden the credentials setup for this integration and move secrets into env vars. Design a key rotation plan for these APIs with minimal downtime. Audit this service for least-privilege access and document what each key can do. Create an environment variable map and a secure .env template for this project. Set up credential separation for dev versus prod with clear audit trails. DO NOT USE WHEN… You want to obtain keys without authorization or bypass security controls. You need legal/compliance sign-off (this outputs technical documentation, not legal advice). INPUTS REQUIRED: List of integrations/APIs and where credentials are currently stored/used. Deployment context (local dev, server, container, n8n, etc.). OPTIONAL: Current config files/redacted snippets (.env, compose, systemd, n8n creds list). Org rules (rotation intervals, secret manager preference). EXAMPLES: “Keys are hard-coded in a Node script and an n8n HTTP Request node.” “We have dev and prod n8n instances and need separation.” OUTPUTS Credential map (service → env vars → scopes/permissions → owner → rotation cadence). Rotation runbook (steps + rollback). Least-privilege checklist and audit log plan. Optional: .env template (placeholders only). Success = no secrets committed or embedded, permissions minimized, rotation steps documented, and auditability defined. WORKFLOW 1. Inventory credentials: where stored, where used, and who owns them. 2. Define separation: dev vs prod; human vs service accounts; per-integration boundaries. 3. Move secrets to env vars / secret manager references: create an env var map and update config plan (no raw keys in code/workflows). 4. Least privilege: for each API, enumerate required actions and reduce scopes/roles accordingly. 5. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills sundial-org/api-credentials-hygiene