Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add niels-emmer/myace --skill secrets-managementgit clone --depth 1 https://github.com/niels-emmer/myaceWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/niels-emmer/myace/secrets-management)<a href="https://agentmods.dev/skills/niels-emmer/myace/secrets-management"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/secrets-management/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/niels-emmer/myace/secrets-management"><img src="https://agentmods.dev/badge/skills/niels-emmer/myace/secrets-management.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00038 | $0.00522 |
| Opus 5 | $0.00019 | $0.00261 |
| Sonnet 5 | $0.00008 | $0.00104 |
| Haiku 4.5 | $0.00004 | $0.00052 |
Grade A, and why
Secrets Management scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 7d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
What it actually says
Purpose
Secrets are the highest-value target in any environment — a leaked credential is a breach waiting to happen. This skill is the checklist for handling secrets so they're injected at deploy time, rotated on a schedule, and never committed, baked, or logged.
When to use it
When adding a new secret, wiring credentials into an application or pipeline, reviewing a diff that touches secrets, or responding to a suspected leak.
Steps / checklist
- Never commit secrets. No credentials, API keys, or tokens in source, config files, or documentation. A committed secret is a compromised secret — rotate it, don't just delete it.
- Secrets manager over files. Secrets live in a secrets manager (Azure Key Vault, AWS Secrets Manager, GCP Secret Manager, Vault) and are injected at deploy time. Not in
.envfiles that get committed, not in image build args. - Managed identity over static secrets. Prefer workload identity (Azure Managed Identity, AWS IAM roles, GCP Workload Identity Federation) over API keys or connection strings wherever the target supports it.
- Least privilege. Each secret is scoped to the service and permission level that needs it. A database credential with admin rights for a read-only service is a finding.
- Rotation. Secrets have a rotation schedule and a rotation path. If a secret can't be rotated without downtime, that's a design defect.
- Never log secrets. Secrets are excluded from logs, error messages, and trace output. Redact on the way in, not on the way out.
- Pipeline hygiene. CI/CD secrets are scoped to the jobs that need them and never exposed to untrusted PRs (fork builds). Pipeline definitions are reviewed like code.
Expected output
A system where no credential exists outside a secrets manager, every secret has a rotation path, and a leaked secret can be rotated without downtime. If a developer needs a teammate to tell them a password, the secrets management work isn't done.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 7d ago First seen · 29 lines · 38 tokens per session scan A b7b4fdbccef7
Secrets Management is a skill published in the GitHub repository niels-emmer/myace (1 stars, last pushed 3d ago), licensed MIT. It adds 38 tokens to every session and 522 once invoked, about $0.0002 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
secrets-management-expert
Store, distribute, rotate and revoke credentials without ever placing them in source: vaults, cloud secret managers, KMS envelope encryption and dynamic credentials. Use when the user mentions secrets, API keys, credentials, HashiCorp Vault, KMS, key rotation, a leaked or committed secret, .env files, sealed secrets…
varlock
Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".env", "API key", "credentials"…
agentsecrets
Zero-knowledge secrets infrastructure — AI agents manage the complete credential lifecycle without ever seeing values.
agentsecrets
Zero-knowledge secrets infrastructure — AI agents manage the complete credential lifecycle without ever seeing values.
idea
Use when capturing ONE new idea the user voices and wants recorded — "save this idea", "I have an idea", "log this idea", "/idea", "idea: ...". Creates a provenance-tracked folder (one folder per idea) in your ideas repo, dedups against an index, optionally mirrors to a GitHub Project view filtered by label:idea. NOT…
pm-feedback
A feedback-analysis aid that turns spreadsheet data, CSV files, pasted text, or review screenshots into organized product insights. It groups themes, identifies sentiment, examines trends and sources, calculates NPS, and extracts user types.