skills.rest
Sir-chawakorn
Sir-chawakornCOMMUNITY
Explore all skills by this author →
GitHub

secrets-management

Detect hardcoded credentials and generate remediation plans for secure vault migration.

9|3|Updated Jun 13, 2026
Search Tags:#security#compliance#encryption#infrastructure#secrets#devsecops
One-click install
npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill secrets-management-sir-chawakorn
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: secrets-management
Source: https://github.com/Sir-chawakorn/sanook-cli/tree/main/skills/secrets-management
Command: npx skills add https://github.com/Sir-chawakorn/sanook-cli --skill secrets-management-sir-chawakorn

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill addresses the critical security risk of hardcoded credentials in source code, CI/CD pipelines, and infrastructure configurations by providing a structured path to secret rotation and secure management.

Core Features & Use Cases

  • Leak Detection: Scans git history and file systems for exposed credentials using industry-standard tools like Gitleaks and TruffleHog.
  • Secret Migration: Guides the transition from plaintext secrets to secure backends like HashiCorp Vault, AWS Secrets Manager, or SOPS.
  • Identity-Based Access: Replaces long-lived static keys with short-lived, workload-based identity tokens (OIDC/Workload Identity).

Quick Start

Use the secrets-management skill to audit the current repository for leaked credentials and generate a remediation plan for moving them to a secure vault.

Frequently Asked Questions about secrets-management

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I scan my git history for hardcoded credentials and exposed secrets?▼

To scan for hardcoded credentials, you can use industry-standard secret scanning tools like Gitleaks and TruffleHog to detect plaintext secrets within your git history and file systems, generating a comprehensive audit of exposed infrastructure credentials.

What is the best way to migrate plaintext secrets to a secure storage backend?▼

The best way to migrate plaintext secrets is to transition them into secure storage backends like HashiCorp Vault, AWS Secrets Manager, or SOPS, ensuring your infrastructure configurations eliminate static secrets and enforce least-privilege access.

How do I replace long-lived static keys with short-lived identity tokens in CI/CD pipelines?▼

To replace long-lived static keys in CI/CD pipelines, implement identity-based authentication using short-lived, workload-based identity tokens like OIDC or Workload Identity, ensuring secure pipeline hardening and eliminating static credential risks.

Can I use this approach for security auditing and cloud migration scenarios?▼

Yes, this approach applies directly to security auditing, cloud migration, and pipeline hardening scenarios by identifying and remediating hardcoded credentials within source code, CI/CD pipelines, and infrastructure manifests to ensure secure cloud infrastructure.

Why do I need to eliminate static secrets from my infrastructure manifests?▼

You need to eliminate static secrets from infrastructure manifests to address the critical security risk of hardcoded credentials in source code and configurations, providing a structured path to secret rotation and secure management with least-privilege access.

Related Skills

Explore More Software Engineering Skills→
arbazkhan971arbazkhan971
26

secrets

Detect exposed secrets and rotate credentials into secret managers.

Community
Advanced
KentoShimizuKentoShimizu
7

security-secrets-management

Automate inventory, rotation, and auditability of API keys and certificates.

Community
Advanced
jonnymuirjonnymuir
1

generic-oidc-offline-token-policy

Restrict OIDC offline token scopes in local Keycloak environments.

Community
Intermediate
Fandry96Fandry96
27

secrets-management

Manage secrets across CI/CD pipelines with Vault and cloud secret managers.

Community
Advanced