skills.rest
kitaekatt
kitaekattCOMMUNITY
Explore all skills by this author →
Website𝕏@truffleGitHub

secrets-kit

Provision age-encrypted fleet credentials with declarative convergence and rotation.

3|1|Updated Feb 21, 2026
Search Tags:#security#encryption#secrets#provisioning#age#fleet
One-click install
npx skills add https://github.com/kitaekatt/plugins-kit --skill secrets-kit
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-kit
Source: https://github.com/kitaekatt/plugins-kit/tree/main/plugins/secrets-kit/skills/secrets-kit
Command: npx skills add https://github.com/kitaekatt/plugins-kit --skill secrets-kit

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill solves the challenge of securely distributing and managing sensitive credentials across a fleet of machines without exposing plain-text secrets in chat transcripts or git history.

Core Features & Use Cases

  • Fleet Provisioning: Automatically materializes age-encrypted secrets onto authorized machines during session start.
  • Secure Rotation: Supports adding, rotating, and removing credentials across the entire fleet using public-key cryptography.
  • Use Case: Use this to manage shared infrastructure tokens or database credentials across multiple developer workstations, ensuring that secrets are only decrypted locally on authorized hardware.

Quick Start

Ask the user for consent to unlock the machine and then run the secrets-kit unlock command with the new-terminal flag to securely enter the passphrase.

Frequently Asked Questions about secrets-kit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I manage fleet secrets without exposing plain-text credentials in chat or git history?▼

Fleet secrets can be managed securely by provisioning age-encrypted credentials from a private repository onto authorized machines, ensuring plain-text values never appear in git history or chat transcripts.

How does age encryption work for provisioning credentials to multiple machines?▼

Age encryption provisions credentials by using public-key cryptography to distribute encrypted secrets from a private repository, which are then decrypted locally only on authorized hardware during session start.

Can I rotate and remove infrastructure tokens across a developer fleet declaratively?▼

Infrastructure tokens can be rotated and removed across a developer fleet using a declarative convergence model that manages the full lifecycle of secrets while maintaining strict security invariants.

What is the best way to securely enter passphrases for encrypted secrets without leaking them to the chat transcript?▼

To securely enter passphrases without leaking them to the chat transcript, use the unlock command with a new-terminal flag to capture hidden input locally, ensuring sensitive data remains outside the chat log.

Does this declarative secret management approach require a private git repository?▼

A private git repository is required to store the age-encrypted secrets, serving as the source from which credentials are materialized onto individual machines during the provisioning process.

Related Skills

Explore More Software Engineering Skills→
DaRacciDaRacci
18

secrets

Manage encrypted secrets with sops-nix and age for NixOS configurations.

Community
Advanced
kk20300113-pngkk20300113-png

setup-browser-cookies

Import decrypted Chromium session cookies into Playwright headless browser sessions.

Community
Intermediate
apakouapakou

E2EE_KeyStorage

Store private cryptographic keys locally and upload public keys to Supabase.

Community
Advanced
ancolemanancoleman
503

managing-secrets

Manage API keys, database credentials, and certificates with HashiCorp Vault.

Community
Advanced