PlugWiki

secrets-management skill (wshobson) for Claude Code: keep CI/CD secrets safe

secrets-management helps Claude set up and use secrets in CI/CD pipelines without hard-coding them.

Installs
13.4K
on skills.sh
Stars
42.1K
on GitHub
Updated
Oct 2026
last repo commit

secrets-management is a skill from wshobson/agents. It loads when you store API keys, manage database passwords, rotate secrets or lock down a CI/CD environment. SKILL.md covers HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, Google Secret Manager, GitHub secrets, GitLab CI/CD variables, rotation, the External Secrets Operator for Kubernetes and secret scanning.

Most of the file is example config for you to adapt: bash, GitHub Actions and GitLab CI YAML, Terraform, a Python rotation function and Kubernetes manifests. The skill bundles no scripts. Some examples use placeholder values such as a Vault dev-server root token, so replace them before real use.

Good for

  • DevOps engineers wiring Vault or AWS Secrets Manager into pipelines
  • Developers moving secrets out of code and into GitHub or GitLab variables
  • Teams adding secret scanning and rotation

Install secrets-management

Claude Code

  1. 1

    Copy this prompt.

    Install the secrets-management skill in Claude Code. Run this command:

npx skills add wshobson/agents --skill secrets-management

Then check that it loaded and tell me how to use it.
  2. 2

    Paste it into Claude Code. It shows the change and asks before running it.

Requires Node.js.

Built from the package data we hold. Not yet tested by us. Source.

What's in the skill

When it loads

Implement secure secrets management for CI/CD pipelines using Vault, AWS Secrets Manager, or native platform solutions. Use when handling sensitive credentials, rotating secrets, or securing CI/CD environments.

Sections in SKILL.md

  1. Purpose
  2. When to Use
  3. Secrets Management Tools
  4. HashiCorp Vault
  5. AWS Secrets Manager
  6. Azure Key Vault
  7. Google Secret Manager
  8. HashiCorp Vault Integration
  9. Setup Vault
  10. GitHub Actions with Vault
  11. GitLab CI with Vault
  12. AWS Secrets Manager
  13. Store Secret
  14. Retrieve in GitHub Actions
  15. Terraform with AWS Secrets Manager
  16. GitHub Secrets

Key facts

Author
wshobson (GitHub account that owns the repo)
Source repo
wshobson/agents
Installs on skills.sh
13,406 as of 2026-11-02
GitHub stars
42,081 (whole repo) as of 2026-11-02
License
MIT
Last repo commit
2026-10-30
Files
1 file (SKILL.md)
skills.sh audits
Gen Agent Trust Hub pass, Socket pass, Snyk pass

What it includes

  • Vault, AWS Secrets Manager, Azure Key Vault and Google Secret Manager compared.

    Secrets tools overview

  • Dev-server setup, plus GitHub Actions and GitLab CI examples that read Vault secrets.

    The setup example starts a Vault dev server and writes a test secret. The CI examples use a Vault token from CI variables.

    Runs code · HashiCorp Vault integration

  • Store a secret, read it in GitHub Actions and use it from Terraform.

    Examples call the aws CLI to create and read secrets.

    Runs code · AWS Secrets Manager

  • Repository and environment secrets, protected and masked variables.

    GitHub secrets and GitLab variables

  • Ten rules, including never commit secrets, rotate often and use least privilege.

    Best practices

  • An AWS Lambda rotation function in Python, and a five-step manual rotation process.

    The Python example reads a secret, generates a new password, updates the database and writes the new secret back. It leaves two helper functions for you to write.

    Write · Secret rotation

  • Kubernetes SecretStore and ExternalSecret manifests that pull from Vault.

    Network · External Secrets Operator

  • A pre-commit hook and a CI job that run TruffleHog.

    The hook runs a TruffleHog Docker image on the repo folder and blocks the commit if it finds a secret.

    Runs code · Secret scanning

From the official docs

Permissions

Medium risk

The skill is Markdown only, but its examples create, read and rotate real secrets when you run them. Test with placeholder values and approve each command before it runs.

What it can do

  • Read your data
  • Create and change things
  • Delete things
  • Read-only mode

Watch out for

  • Examples create and rotate real secrets

    SKILL.md shows aws secretsmanager create-secret, vault kv put and a Lambda that updates a database password. Run them only against test resources first. github.com

  • Examples use placeholder credentials

    The Vault setup sets VAULT_TOKEN to root on a dev server, and the AWS example has a literal password. Replace these with your own values and never reuse them. github.com

  • The pre-commit hook runs a Docker image

    The scanning example runs trufflesecurity/trufflehog:3.88 against your repo folder. Install it only if you want that hook. github.com

  • The plugin route adds more than this skill

    The cicd-automation plugin folder holds 4 skills, 5 agent file(s) and 1 command file(s), plus plugin.json files. The repo tree shows no hooks or MCP config in it. The skills CLI route installs only this skill. github.com

Questions

How do I install the secrets-management skill?

Use the install box above. The skills CLI command installs only this skill. The plugin route installs cicd-automation, which also holds three other skills, five agent files and a command file.

Does Claude get access to my secrets?

The skill is instructions and example config, and it bundles no scripts. If Claude runs aws or vault commands from the examples, review each one first.

Does it need an API key?

The skill does not ask for one. The examples use credentials for the services you pick, such as a Vault token or AWS access keys, which you supply through your own CI variables.

Which secret stores does it cover?

HashiCorp Vault, AWS Secrets Manager, Azure Key Vault and Google Secret Manager are described. Worked examples exist for Vault, AWS, GitHub, GitLab and the External Secrets Operator. Azure and Google get a feature summary only.

What related skills does it point to?

SKILL.md lists github-actions-templates, gitlab-ci-patterns and deployment-pipeline-design under Related Skills. They are in the same cicd-automation plugin, and are not required.

Is secrets-management safe to install?

The skill is one Markdown file with no scripts, so installing it alone adds instructions only. Its examples touch real secrets when you run them, so use placeholder values while testing and never paste live secrets into chat.

Information

updated Nov 2, 2026

Repository
wshobson/agents
Folder
plugins/cicd-automation/skills/secrets-management

wshobson/agentsskills.sh

Sources

Docs, issue trackers and discussions this page is built from.

Show all 5
  1. wshobson/agents README · github.com
  2. Claude Code skills · code.claude.com
  3. Using skills in Claude · support.claude.com
  4. SKILL.md · github.com
  5. secrets-management on skills.sh · skills.sh

Updated Nov 2, 2026.