secret-rotation

Detect hardcoded secrets and evaluate rotation policies in codebases.

8|4|Updated Feb 7, 2026

Search Tags:#security #audit #compliance #secrets #vault #rotation #secret-management

Ready to run

npx skills add https://github.com/adrien-barret/claude-kit --skill secret-rotation

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: secret-rotation
Source: https://github.com/adrien-barret/claude-kit/tree/main/project-template/.claude/skills/security/secret-rotation
Command: npx skills add https://github.com/adrien-barret/claude-kit --skill secret-rotation

SYSTEM DOCUMENTATION & REQUIREMENTS

## What problem does it solve? Validate secret storage practices and rotation policies to prevent leaked credentials and ensure compliant secret lifecycle management across a codebase.

## Core Features & Use Cases

Discover hardcoded secrets and insecure configurations in source code, config files, and deployment manifests.
Assess secret manager usage (Vault, AWS Secrets Manager, etc.) and verify that secrets are referenced securely, not embedded.
Evaluate rotation schedules and automation, generating remediation steps and improvement recommendations.
Use Case: Audit a repository to identify exposed credentials and verify rotation plans before deployment.

### Quick Start Run a scan against a target path to detect secrets, validate rotation configuration, and produce a remediation report. Example: secret-rotation --path ./my-project --output secret-rotation-report.md

Frequently Asked Questions about secret-rotation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I detect hardcoded secrets in my source code and config files?▼

To detect hardcoded secrets, scan your codebase across source files, configuration, and deployment manifests. This process identifies exposed credentials and evaluates whether secrets are embedded directly rather than referenced securely from a secret manager.

Can I check if my Vault and AWS Secrets Manager configurations are referenced securely?▼

Secret rotation evaluates Vault and AWS Secrets Manager usage by verifying that secrets are referenced securely rather than embedded. It checks your configuration to ensure secret managers are implemented correctly and credentials are retrieved dynamically.

How do I audit secret rotation schedules and policies in a repository?▼

Auditing secret rotation schedules involves analyzing your codebase to evaluate existing rotation policies and automation. The scan generates a structured report detailing current rotation timelines and providing remediation steps for non-compliant secrets.

What does a secret rotation remediation report include?▼

After scanning your codebase, secret rotation produces a concise structured report containing detected secrets, secret manager usage, rotation schedules, and remediation guidance. This output can be exported as a markdown file for compliance tracking.

What is the best way to validate secret lifecycle management before deployment?▼

The best way to validate secret lifecycle management is running a comprehensive scan against your target project path. This identifies insecure configurations, validates rotation automation, and produces remediation recommendations to ensure compliant deployment.

Do I need any external dependencies to scan for insecure secret configurations?▼

Secret rotation scans source files, configuration, and deployment manifests without requiring external dependencies. It operates directly on your target path to analyze secret storage practices and evaluate rotation policies in standalone environments.