secret-breach-response

Detect leaked credentials in repositories, logs, or artifacts and initiate incident response.

5|Updated Nov 18, 2025

Search Tags:#audit #compliance #rotation #incident-response #breach #secret

Ready to run

npx skills add https://github.com/DuqueOM/ML-MLOps-Portfolio --skill secret-breach-response

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-breach-response
Source: https://github.com/DuqueOM/ML-MLOps-Portfolio/tree/main/.devin/skills/secret-breach-response
Command: npx skills add https://github.com/DuqueOM/ML-MLOps-Portfolio --skill secret-breach-response

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Leaks of credentials and secrets threaten cloud workloads, CI pipelines, and code history. This Skill provides an actionable playbook to detect, classify, contain, and document secret breaches, reducing blast radius and time-to-remediation.

Core Features & Use Cases

Automated detection and classification of exposed credentials (AWS keys, service accounts, API keys, etc.).
Guided revocation, credential rotation, access auditing, and incident post-mortem documentation.
Use case: When a secret is found in a repository, trigger automated containment and a structured remediation workflow, including notifying stakeholders.

Quick Start

Initiate the incident playbook for a leaked secret by triggering detection, revocation planning, rotation, access audit, and post-mortem documentation.

Frequently Asked Questions about secret-breach-response

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I handle a leaked secret found in git history or CI/CD pipelines?▼

To handle a leaked secret in git history or CI/CD pipelines, you must detect, classify, and contain the exposed credential. This Skill orchestrates the incident response by guiding revocation, rotation, and access auditing to reduce the blast radius.

What is the process for revoking and rotating cloud credentials after a breach?▼

Revoking and rotating cloud credentials after a breach involves classifying the exposed key and executing a structured remediation workflow. This Skill guides the revocation, credential rotation, and access auditing while enforcing human approval for destructive actions.

Can I automate incident response for API keys without risking unintended destructive actions?▼

Yes, you can automate incident response for leaked API keys while preventing unintended destructive actions. This Skill enforces auto-detection combined with mandatory human approval for destructive actions, ensuring safe credential rotation and revocation.

How do I document a post-mortem after a credential leak in a repository?▼

To document a post-mortem after a credential leak in a repository, you need to generate structured incident records. This Skill produces post-mortem documentation alongside the access audit, capturing the full containment and remediation workflow.

Does this secret breach response workflow support AWS keys and service accounts?▼

Yes, this secret breach response workflow supports AWS keys, service accounts, and API keys. It applies detection and classification across CI/CD pipelines, git history, and cloud credentials to initiate appropriate incident response protocols.