Keep credentials out of code, logs, bundles and history — one supply path, scoped per environment, rotatable on demand — and run the rotate-first response when one has already leaked. Use when adding or moving a key, token, connection string or signing secret, when a scanner or reviewer finds one committed, when a credential appears in logs or a client bundle, or when rotation is due. Not for deciding what a credential may access, and not for vulnerability advisories in dependencies.
Collected from public GitHub. Every version is saved exactly as it was and never changes. Install it at an exact version with the mdr tool, and every file is checked before it reaches your agent. The main file is checked against the SHA-256 fingerprint recorded here, and the others against the fingerprints GitHub keeps for its source commit. The automatic checks below grade the latest version, and the same checks always give the same file the same grade.
What the file says
# Secrets management
Two different jobs share one skill because the second is always urgent and the first is what stops
it recurring. If a secret has already leaked, start at **When one has leaked** and come back after.
## When this fires
A credential is being introduced, moved, shared or rotated; a scanner, review or log inspection
turns one up; a key needs to reach a new environment or service. It does not fire for deciding
what a credential is permitted to do once valid.
## Procedure — keeping them out
1. **Inventory what counts.** API keys, database URLs carrying passwords, private and signing keys,
OAuth client secrets, webhook signing secrets, session secrets, cloud credentials. For each:
which environments it exists in, who owns it, where it is stored, how it is rotated. A secret
nobody owns is a secret nobody rotates.
2. **Establish one supply path and make everything else a defect.** Injected at runtime from the
platform's secret store or environment, read once at startup through a single config module.
Committed `.env` files, hardcoded fallback defaults, secrets in CI configuration files, build
…
The line at the top of this page pins the label git:20260919.a0d4f55, which is what most people want. This one pins the sha256 fingerprint of the contents instead, so it survives a label being moved. Either way the exact version is written to mdr.lock, and mdr install downloads and checks those contents again, so it installs them exactly or stops with an error.
GET https://markdownregistry.com/api/v1/artifacts/art_r7535rswgqmwycfa
GET https://markdownregistry.com/api/v1/resolve?ref=nahid-sparktales/agent-dispatcher/secrets-management
GET https://markdownregistry.com/api/v1/blob/131294ae11e555948192942e1e29a55c745c9271c13db775d3984ec1fb760c4a
Your AI assistant does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.
nahid-sparktales/agent-dispatcher · skills/agent-dispatcher/SKILL.md · Handle requested Agent Dispatcher work with direct execution or prepared specialist guidance. Includes named roles…
nahid-sparktales/agent-dispatcher · skills/ai/agent-design/SKILL.md · Scope an agent or subagent before it is built — the one job it owns, the smallest tool set that closes that job, what…
nahid-sparktales/agent-dispatcher · skills/ai/agent-evals/SKILL.md · Build an eval suite that can actually detect a regression — cases pulled from real traffic, graders that check…
nahid-sparktales/agent-dispatcher · skills/ai/context-engineering/SKILL.md · Decide what actually occupies the model's window — progressive disclosure through an index, retrieval versus inlining…
nahid-sparktales/agent-dispatcher · skills/ai/llm-observability/SKILL.md · See what an agent actually did — one trace per run with nested model, tool and retrieval spans, token and latency…
nahid-sparktales/agent-dispatcher · skills/ai/mcp-design/SKILL.md · Build an MCP server, or bring an existing one into a project — choosing the transport, deciding which tools, resources…
nahid-sparktales/agent-dispatcher · skills/ai/memory-design/SKILL.md · Decide what an agent should remember, which layer holds it, who it is scoped to, and how a stale or contradicted memory…
nahid-sparktales/agent-dispatcher · skills/ai/model-routing/SKILL.md · Pick a model per job and degrade sensibly when one fails — a quality bar per call site, candidates compared on the same…
nahid-sparktales/agent-dispatcher · skills/ai/prompt-engineering/SKILL.md · Write or revise a prompt so it holds up — output contract, instruction placement, examples that earn their place, an…
nahid-sparktales/agent-dispatcher · skills/ai/prompt-injection-defense/SKILL.md · Treat everything an agent reads but did not author as data rather than instructions — an explicit trust boundary, a…
nahid-sparktales/agent-dispatcher · skills/ai/retrieval-rag/SKILL.md · Build and fix retrieval that actually returns the right passage — structure-aware chunking, one pinned embedding model…
nahid-sparktales/agent-dispatcher · skills/ai/structured-output/SKILL.md · Get parseable, trustworthy structured results out of a model — schema design, the enforcement mechanism the provider…
okhp3/skillz · community/secrets-management/SKILL.md · Handles credentials safely through their whole life — where they live, how code gets them, how they rotate, and what to…
aniruddhadas1/oniroute_swarmagents · skills/official/security/secrets-management/SKILL.md · Govern sensitive credentials across creation, storage, access, rotation, and retirement. Use for planning, evaluation…
