skills.rest
RightNow-AI
RightNow-AIOFFICIAL
Explore all skills by this author →
Website𝕏@rightnowai_coGitHub

infisical-sync-skill

Synchronizes secrets between a self-hosted Infisical instance and a local encrypted vault.

18.2k|2.3k|Updated Feb 24, 2026
Search Tags:#credentials#Security#Automation#infisical#Vault#Sync#Secrets Management
One-click install
npx skills add https://github.com/RightNow-AI/openfang --skill infisical-sync-skill
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: infisical-sync-skill
Source: https://github.com/RightNow-AI/openfang/tree/main/crates/openfang-hands/bundled/infisical-sync
Command: npx skills add https://github.com/RightNow-AI/openfang --skill infisical-sync-skill

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Keeping agent credentials consistent across a fleet is error-prone when secrets live in scattered local stores. This Skill provides the expert knowledge to authenticate with a self-hosted Infisical instance via Universal Auth, pull secrets into a local encrypted vault on a schedule, and push new secrets back so Infisical remains the single source of truth.

Core Features & Use Cases

  • Scheduled Secret Pull: Authenticate with a Machine Identity, fetch secrets from the Infisical v4 API per project and environment, and write changed values into the local vault using hash-based change detection.
  • Push and Delete Operations: Create-or-update secrets in Infisical using the POST-then-PATCH pattern, and remove secrets from both Infisical and the local vault after confirmation.
  • State Tracking and Metrics: Persist sync state in a JSON file, record secret metadata in a knowledge graph, and publish dashboard metrics such as secrets synced, last sync time, and error counts.
  • Use Case: An autonomous agent wakes every 15 minutes, obtains a fresh access token, pulls the production environment secrets from Infisical, updates only changed vault entries, and reports sync status to the dashboard without ever logging secret values.

Quick Start

Ask the agent to sync secrets from your Infisical instance into the local vault after setting the INFISICAL_URL, INFISICAL_CLIENT_ID, and INFISICAL_CLIENT_SECRET environment variables.

Frequently Asked Questions about infisical-sync-skill

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I sync secrets from Infisical to a local vault?▼

Authenticate via POST /api/v1/auth/universal-auth/login with your machine identity credentials, then call GET /api/v4/secrets with the projectId and environment. Write each returned secret into the local vault with vault_set, skipping unchanged entries by comparing SHA-256 hashes.

How do I create or update a secret with the Infisical API?▼

The Infisical API has no single upsert endpoint, so use a create-then-update pattern. POST to /api/v4/secrets/{secretName} first; if it returns 409 because the secret exists, send a PATCH to the same endpoint with the new value.

What environment variables does Infisical sync require?▼

Three variables are required: INFISICAL_URL for the instance base URL, INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET for the machine identity. Optional variables include INFISICAL_PROJECT_ID, INFISICAL_ENVIRONMENT, and INFISICAL_SYNC_INTERVAL.

Why does Infisical return 403 Forbidden when fetching secrets?▼

A 403 means the machine identity exists but lacks permissions on the project. In Infisical, go to Access Control, find the identity under Machine Identities, and assign it the member role, or viewer for read-only access.

How are secret values protected during synchronization?▼

Secret values are never logged, stored in memory, or included in event payloads; all log messages use redacted placeholders. Access tokens are session-local only and never persisted to memory or the vault, and change detection uses SHA-256 hashes instead of stored values.

Related Skills

Explore More Software Engineering Skills→
charchesscharchess
1

vixens-infisical

Troubleshoot Infisical-to-Kubernetes secrets synchronization and InfisicalSecret authentication failures.

Community
Advanced
AI-Foundry-CoreAI-Foundry-Core
4

secrets-management

Manage secrets in CI/CD pipelines using Vault, AWS Secrets Manager, Azure Key Vault, and Google Secret Manager.

Official
Advanced
JBODE-mhhsJBODE-mhhs

system-diagnostics

Detect stale tasks, overdue goals, and fleet health issues via zeus bus commands.

Community
Intermediate
Camilo8902Camilo8902

env-secrets-manager

Manage environment variables and secrets with encryption, rotation, and provider integration.

Community
Advanced