AI agent skill · by @aiming-lab

Secrets Management

Use this skill when handling API keys, passwords, tokens, private keys, or any sensitive credential. Never hardcode secrets in source code — apply this whenever the word "key", "token", "password", or "secret" appears in the task.

Archived 2026-10-23 · Source updated 2026-06-07 · License: MIT. Check the original repository for the latest version.

SKILL.md instructions

# Secrets Management

**Rules:**
1. **Never** hardcode secrets in source files, configs committed to git, or logs.
2. Use environment variables for local development (`python-dotenv`).
3. Use a secrets manager (AWS Secrets Manager, HashiCorp Vault, 1Password CLI) in production.
4. Add `.env` and `*.pem` to `.gitignore` before the first commit.
5. Rotate secrets immediately if they are exposed (leaked in a commit, log, or error message).

**Scanning:** Use `ggshield`, `truffleHog`, or `git-secrets` in CI to block secret commits.

**Anti-patterns:**
- `os.environ.get('KEY', 'hardcoded_default')` in production code.
- Logging full request/response bodies that may contain tokens.