secrets-architect SKILL.md skillA
secrets-architect from ralvarez-ai/ralvaskills is an agent skill: a SKILL.md folder an AI agent loads when a task calls for it.
mdr add ralvarez-ai/ralvaskills/secrets-architect@v1.1.1Pins v1.1.1 in mdr.lock. Pin the fingerprint instead.
- Audit grade
- A, 17 of 17 checks passed
- Kind
- SKILL.md skill
- Repository
- ralvarez-ai/ralvaskills
- Path
skills/infra/secrets-architect/SKILL.md- Versions recorded
- 3
- Latest version
- v1.1.1, committed Oct 11, 2026
- First version recorded
- Oct 11, 2026
- Size
- 10,623 bytes
- Repository stars
- 4
- License
- GPL-3.0
Secret-handling standards for one external store consumed by reference — consumer decision matrix (Compose secrets, *_FILE, systemd LoadCredential, plain bind mount, CI), permission/uid rules, naming, migration workflow, live verification, pitfalls. Use when wiring a credential into a repo, container, systemd unit or CI job, migrating secrets out of .env or git, or auditing a secrets store.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Secrets Architect
**Every credential lives in one secrets store, outside every repo. Consumers read it by reference — never a copied value.** No secret value in git, in a `.env`, or in a container environment.
Targets **`$SECRETS_DIR`** (default `~/Secrets`) as the store. The canonical long-form walkthrough — the full narrative, verification log and instance layout — lives in the chezmoi repo's `docs/secrets-methodology.md`; this skill is the portable, agent-facing core.
## 1. Principles
- **One store, many consumers.** `$SECRETS_DIR` is the single source of truth; repos reference paths, never values.
- **Match the mechanism to the consumer** (see §3). The consumer's shape — file reader, env app, oneshot, shell, writable state, CI — picks the mechanism.
- **Paths have a default.** Build from `${SECRETS_DIR:-$HOME/Secrets}` so a stack works without a per-secret variable being defined.
- **Least privilege, but respect the reader's uid.** Default `600`, except files a non-root process opens directly.
- **Verify against the running system, not just the source.** The deployed artifact can lag the repo.
…Read the whole file at its exact version.
How to install
mdr add ralvarez-ai/ralvaskills/secrets-architect@sha256:b3e093a1104e64d2The line at the top of this page pins the label v1.1.1, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
[](https://markdownregistry.com/a/art_6f4n2iiljdpqjki6)
1 badge image fetches in 30 days. What the badge shows.
Versions
The registry has recorded 3 versions of this file, all committed on Oct 11, 2026.
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| v1.1.1 latest | 2026-10-11 | bd3b888 | 10,623 B | A | view · diff |
| v1.1.0 | 2026-10-11 | 48faaa9 | 10,629 B | A | view · diff |
| v1.0.0 | 2026-10-11 | a3f23e3 | 8,324 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (10623 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
ralvarez-ai/ralvaskills · 4 stars · license GPL-3.0 · pushed 2026-11-02 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_6f4n2iiljdpqjki6 GET https://markdownregistry.com/api/v1/resolve?ref=ralvarez-ai/ralvaskills/secrets-architect GET https://markdownregistry.com/api/v1/blob/b3e093a1104e64d254c7a66a145ae3d899b9efc11d237ac439ee16ff014c7b97
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
Guides: the SKILL.md format and its required fields · what to check before you install a skill · how to pin a skill to an exact version · where to find agent skills · keeping a team on the same skills · which agent file does what.