Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add niels-emmer/myace --skill secrets-managementgit clone --depth 1 https://github.com/niels-emmer/myaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niels-emmer/myace/secrets-management)<a href="https://agentmods.dev/skills/niels-emmer/myace/secrets-management"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/secrets-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niels-emmer/myace/secrets-management"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/secrets-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00522 |
| Opus 5.5 | $0.00015 | $0.00209 |
| Sonnet 5.5 | $0.00008 | $0.00104 |
| Haiku 4.5 | $0.00004 | $0.00052 |
Grade A, and why
Secrets Management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Purpose
Secrets are the highest-value target in any environment — a leaked credential is a breach waiting to happen. This skill is the checklist for handling secrets so they're injected at deploy time, rotated on a schedule, and never committed, baked, or logged.
When to use it
When adding a new secret, wiring credentials into an application or pipeline, reviewing a diff that touches secrets, or responding to a suspected leak.
Steps / checklist
- Never commit secrets. No credentials, API keys, or tokens in source, config files, or documentation. A committed secret is a compromised secret — rotate it, don't just delete it.
- Secrets manager over files. Secrets live in a secrets manager (Azure Key Vault, AWS Secrets Manager, GCP Secret Manager, Vault) and are injected at deploy time. Not in
.envfiles that get committed, not in image build args. - Managed identity over static secrets. Prefer workload identity (Azure Managed Identity, AWS IAM roles, GCP Workload Identity Federation) over API keys or connection strings wherever the target supports it.
- Least privilege. Each secret is scoped to the service and permission level that needs it. A database credential with admin rights for a read-only service is a finding.
- Rotation. Secrets have a rotation schedule and a rotation path. If a secret can't be rotated without downtime, that's a design defect.
- Never log secrets. Secrets are excluded from logs, error messages, and trace output. Redact on the way in, not on the way out.
- Pipeline hygiene. CI/CD secrets are scoped to the jobs that need them and never exposed to untrusted PRs (fork builds). Pipeline definitions are reviewed like code.
Expected output
A system where no credential exists outside a secrets manager, every secret has a rotation path, and a leaked secret can be rotated without downtime. If a developer needs a teammate to tell them a password, the secrets management work isn't done.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 29 lines · 38 tokens per session scan A b7b4fdbccef7
Secrets Management is a skill published in the GitHub repository niels-emmer/myace (1 stars, last pushed today), licensed MIT. It adds 38 tokens to every session and 522 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
secrets-management-expert
Store, distribute, rotate and revoke credentials without ever placing them in source: vaults, cloud secret managers, KMS envelope encryption and dynamic credentials. Use when the user mentions secrets, API keys, credentials, HashiCorp Vault, KMS, key rotation, a leaked or committed secret, .env files, sealed secrets…
idiomatic-go
Apply Go community idioms for API and package design, error and concurrency patterns, naming (initialisms, stutter, receivers), generics vs interfaces, and Go code review — including PR or diff review, questions about "the Go way", pointer vs value receivers, channels vs mutexes, and building Go language tooling…
eclipse-license-check
Vet third-party dependencies for an Eclipse Foundation project with the Eclipse Dash License Tool — license checks, "do I need to vet X?" questions, IPLab review filing, and release IP due diligence. Use whenever the user mentions Eclipse license checking, dash-licenses, the Dash License Tool, IPLab, third-party…
go-documentation
Write idiomatic Go doc comments that render correctly on pkg.go.dev — package comments, doc.go, exported-symbol comments, testable Example functions, deprecation notices — and publish or debug modules on pkg.go.dev (pkgsite, the module proxy). Use when writing or reviewing Go documentation, or when a developer used to…
publish-vscode-extension
Publish a VS Code extension to the VS Code Marketplace and/or Open VSX Registry. Use when the user wants to publish, ship, or release a VS Code extension; audit or improve manifest, listing, or release setup; build or upload a .vsix; set up vsce or ovsx; create a marketplace publisher or Open VSX namespace; configure…
statemachine-dsl
Read, write, and modify Statemachine DSL files (.statemachine). Use when the user wants to create, edit, explain, or debug a state machine written in this textual DSL — defining states, events, commands, and transitions, or generating a machine from a description.