secrets

secrets is a command for Claude Code from nitinjain999/platform-skills. It costs 31 tokens per session (4,256 once invoked), scanned A, original, Apache-2.0.

A command for designing and managing application secrets, such as passwords, API keys, and tokens, in Kubernetes. It covers External Secrets Operator and Sealed Secrets, two ways to store and deliver secrets safely.

In plain words
What is it for?
Use it to choose a secrets strategy, create or troubleshoot secret resources, rotate credentials, back up encryption keys, and audit Kubernetes secrets.
Why use it?
It helps prevent plain secrets, broken synchronisation, expired credentials, and unhealthy secret resources from being overlooked.

Command for Claude Code

Written for Claude Code: argument-hint in frontmatter.

Part of the platform-skills plugin — 1 skill, 43 commands shipped together

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods
npx agentmods add commands/nitinjain999/platform-skills/secrets
Clone the repo
git clone --depth 1 https://github.com/nitinjain999/platform-skills

Made for: Claude Code.

Or install platform-skills, the plugin that ships this one along with the rest of its 1 skill, 43 commands.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

agentmods badge for secrets

README.md
[![agentmods](https://agentmods.dev/badge/commands/nitinjain999/platform-skills/secrets.svg)](https://agentmods.dev/commands/nitinjain999/platform-skills/secrets)
Your own site
<a href="https://agentmods.dev/commands/nitinjain999/platform-skills/secrets"><img src="https://agentmods.dev/badge/commands/nitinjain999/platform-skills/secrets.svg" alt="Measured on agentmods" height="20"></a>
Per session 31 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.
When invoked 4,256 The whole file, excluding the scripts and references it only reads on demand.
Security scan A 1 finding. Scan, not verified.
Origin original No closer match found in the catalogue.
Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

ModelPer sessionOnce invoked
Fable 5.1 $0.00031 $0.04256
Opus 5 $0.00015 $0.02128
Sonnet 5 $0.00006 $0.00851
Haiku 4.5 $0.00003 $0.00426

Measured 6d ago against content hash f2704303eb98, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-06, from the pricing page.

Security

Grade A, and why

secrets scanned grade A with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 6d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Makes network callslowCapability

Not a fault in itself. Listed so you know the mod talks to something, and to what.

sh -c 'wget -qO- http://localhost:8080/healthz || curl -sf http://localhost:8080/healthz'
commands/secrets.md · 485 lines

How it starts

The opening of the file, as written. The whole thing — 485 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Secrets Command

Structured guidance for secrets strategy, External Secrets Operator, Sealed Secrets, rotation, and Kubernetes-side secrets audit.

Activation

/platform-skills:secrets design   # ESO vs Sealed Secrets decision; choose a strategy for the cluster
/platform-skills:secrets eso      # ExternalSecret/SecretStore scaffold; debug sync errors
/platform-skills:secrets sealed   # seal, rotate, backup master key; troubleshoot decryption failures
/platform-skills:secrets rotate   # rotation runbook — update provider value, force sync, verify pods reload
/platform-skills:secrets audit    # find bad SA tokens, unhealthy ExternalSecrets, missing secrets

Interactive Wizard (fires when no mode is provided)

When invoked with no arguments, ask before proceeding:

Q1 — Mode?

What do you need?
  1. design   — choose ESO vs Sealed Secrets for a cluster or workload
  2. eso      — scaffold ExternalSecret/SecretStore, or debug a sync error
  3. sealed   — seal a new secret, rotate an existing one, or back up the master key
  4. rotate   — end-to-end rotation runbook for a live secret
  5. audit    — find service account token secrets, unhealthy ExternalSecrets, plain secrets in Git

Enter 1–5 or mode name:

Q2 — Context (after mode selected):

  • design: What is the backend — AWS Secrets Manager, Azure Key Vault, HashiCorp Vault, or no cloud provider?
  • eso: Paste the ExternalSecret or SecretStore YAML, or describe the sync error.
  • sealed: New secret or rotating an existing one? Which namespace?
  • rotate: Which secret is rotating — database password, API key, TLS cert? Which backend?
  • audit: Cluster name and namespace scope. Any specific concern — Git scan, SA tokens, ESO health?

Mode: design

Triggers: which pattern, ESO vs Sealed Secrets, choose secrets strategy, what should I use

Read references/secrets.md before responding.

Decision matrix

Pattern Best for Tradeoff
External Secrets Operator (ESO) Cloud-native backends: AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, HashiCorp Vault Runtime dependency on provider; requires workload identity or static credentials
Sealed Secrets Air-gapped or GitOps-first teams; no external runtime dependency Rotation requires re-sealing and a Git commit; master key backup is critical

Read the full file on GitHub · 485 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

  1. 6d ago First seen · 485 lines · 31 tokens per session scan A f2704303eb98

Subscribe to this mod's changes

secrets is a command published in the GitHub repository nitinjain999/platform-skills (41 stars, last pushed 5d ago), licensed Apache-2.0. It adds 31 tokens to every session and 4,256 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 1 finding (makes network calls). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.