Secrets and Credentials skills for Claude Code and Codex
Skills for handling secrets and credentials safely: AWS Secrets Manager, secret scanning, rotation, .env schemas with Varlock, workload identity, API key management and signing checks. They help an agent keep keys out of code and logs and rotate them when they leak.
Highest-scoring secrets management skills in the October 22, 2026 snapshot: secret-serialization from getsentry/skills (86/100), secrets-rotation from avelikiy/great_cto (82/100) and auth-guide from makenotion/notion-cookbook (82/100). Scores come from the Suede Skill Check.
- 18 listed skills
- 11 repositories
- 6 with full pages
13 from official publishers. 0 bundle scripts. 3 connect to an outside service. Listed in Developer Tools and Frameworks (5), Security (5), DevOps and Cloud (5), AI Agents and LLM Engineering (2), Code Review and Code Quality (1).
All 18 secrets management skills
No matching skills. Try fewer words or clear your search.
| Skill | Repository | What it does |
|---|---|---|
| auth-guide 82/100 · B | makenotion/notion-cookbook | Guides setting up third-party authentication for a Notion Worker, covering brokered credentials for API keys and tokens, OAuth, and plaintext environment secrets. |
| authsome 77/100 · C | agentrhq/authsome | Lets an agent call external services such as Gmail, GitHub, and Stripe with plain HTTP requests while a gateway injects the credentials automatically. |
| oauth 80/100 · B | mcollina/skills | Implements OAuth 2.0 and 2.1 authorization flows in Fastify applications, including PKCE, client credentials, device flow, refresh token rotation, and JWT validation. |
| secret-serialization 86/100 · B | getsentry/skills | Finds secrets, tokens, passwords, and API keys that can leak through generated serialization, structured logs, tracing spans, and error reports in Python and JavaScript. |
| secrets-rotation 82/100 · B | avelikiy/great_cto | Handles exposed secrets, such as ones pasted into chat or committed, by treating them as compromised and making revocation and rotation one tracked task. |
| varlock 75/100 · C | wrsmith108/varlock-claude-skill | Manages environment variables and secrets with Varlock so secrets are never exposed in terminals, logs, traces, or Claude's context. |
| agents-harden 74/100 · C | aws/agent-toolkit-for-aws | Use when preparing your agent for production — IAM scoping, inbound auth (JWT, SigV4), secrets management, cold start optimization, session… |
| aws-secrets-manager 72/100 · C | aws/agent-toolkit-for-aws | Secret safety for AWS Secrets Manager, secret management, credentials, API keys, tokens, and passwords. Prevents AI agents from directly fetching… |
| creating-secrets-using-best-practices 74/100 · C | aws/agent-toolkit-for-aws | Creates and manages secrets in AWS Secrets Manager following security best practices. Always use this skill when creating secrets — it sets up… |
| gke-workload-identity 85/100 · B | google/skills | Configures and diagnoses Workload Identity Federation for GKE authentication failures for Pods (403 "iam.serviceAccounts.getAccessToken" /… |
| google-cloud-recipe-auth 72/100 · C | google/skills | Provides expert guidance on Identity and Access Management (IAM) and authenticating and authorizing to Google Cloud services and APIs, covering… |
| secret-scanning 80/100 · B | github/awesome-copilot | Guide for configuring and managing GitHub secret scanning, push protection, custom patterns, and secret alert remediation. For pre-commit secret… |
| setting-up-ec2-instance-profiles 74/100 · C | aws/agent-toolkit-for-aws | Configures EC2 instances to securely call AWS services by creating and attaching IAM roles via instance profiles, eliminating hardcoded credentials… |
| signing-in-to-aws 72/100 · C | aws/agent-toolkit-for-aws | Gets AWS credentials for CLI/SDK access via `aws login`. Activates when a developer needs to authenticate to AWS for local development, when an AWS… |
| signing-preflight 74/100 · C | avelikiy/great_cto | Before the first commit of a session, check that commit signing will work — the key is loaded and unlocked — and ask the operator to unlock it once… |
| venice-api-keys 70/100 · C | veniceai/skills | Manage Venice API keys. Covers GET/POST/PATCH/DELETE /api_keys, GET /api_keys/{id}, GET /api_keys/rate_limits, GET /api_keys/rate_limits/log, the… |
| venice-auth 70/100 · C | veniceai/skills | Authenticate to the Venice API with a Bearer API key or with an x402 / SIWX wallet (EVM on Base, including EIP-1271 smart wallets, or Ed25519 on… |
| vercel-cli-with-tokens 78/100 · C | vercel-labs/agent-skills | Deploy and manage projects on Vercel using token-based authentication. Use when working with Vercel CLI using access tokens rather than interactive… |
How to choose secrets management skills
Use a scanning skill to find secrets already in a repository, then a storage skill (Secrets Manager, Varlock, workload identity) so new ones never land in code.
These skills touch credentials directly. Read SKILL.md before installing, and confirm that the agent never prints secret values into the transcript.
Rotation skills change live keys. Run them with the owning service's team, and check every consumer picks up the new value before the old one is revoked.
Related topics
Authentication and Login 16AWS 151Google Cloud 146LLM APIs and SDKs 28Security Auditing and Review 108Deployment and Hosting 40Git and Version Control 39Kubernetes 72
Find your next useful skill
Explore Rising Skills with quality scores and source reports, or search from inside your agent.
Get Rising Skills by email · Read Rising Skills · Install the finder · State of Agent Skills