All skills
secret-configuration-security
FoundationJIT onlyanalysis-agent/task-agent/review-agent: use when secrets, KMS/env config, rotation, logging, redaction, or rollback changes; skip non-sensitive config.
- Group
- Security & privacy
- Supported roles
- MainAnalysisTaskReview
- Source
- SKILL.md
Use when
Trigger signals that make this skill the right owner
- secret or sensitive-config change affects exposure path, storage, access, redaction, rotation, revocation, or recovery
- rendered client, CI, image, log, manifest, or support artifact may expose credential material
Do not use when
Anti-triggers — as binding as the triggers above
- configuration change contains no secret or security-sensitive value and does not alter an exposure boundary
Required inputs
What must be supplied before this skill can decide anything
- current task contract
- selected primary Professional Skill
- task-local trigger evidence
Output contract
What this skill owes the next role
- Return a secret-configuration decision: map exposure, access scope, rotation, revocation, redaction, recovery, owner, and residual exposure
Escalation signals
When this skill must hand the decision back
- Secret leaks unsafe defaults and broad key policies create immediate operational exposure
Loaded by
This skill never owns a task. These professionals may pull it in as Layer 3.
Targeted references
Each reference carries its own load condition. None of them enter context by default.
| Reference | Load when | Do not load when | Required by |
|---|---|---|---|
| benchmarks-and-patterns.mdbenchmark-pattern | multiple exposure paths or rotation mechanisms remain plausible | one approved lifecycle resolves the changed secret boundary | AnalysisTaskReview |
| checklist.mddecision-checklist | secret or sensitive-config change affects exposure storage access rotation redaction or recovery | no secret or security-sensitive config boundary changes | AnalysisTaskReview |
| evidence-patterns.mdevidence-pattern | no-leak least-privilege redaction rotation or recovery claims need fresh proof | no secret/config security claim awaits validation | AnalysisTaskReview |