securitysecrets
Secrets Management security skill
When & Why to Use This Skill
This Claude skill provides a comprehensive framework for Secrets Management, designed to safeguard API keys and sensitive credentials throughout their entire lifecycle. It addresses critical security vulnerabilities by enforcing best practices in memory handling, configuration file permissions, and logging prevention, ensuring that sensitive data is never exposed in source code, logs, or system dumps.
Use Cases
- Automated Security Auditing: Scan codebases and configuration files to identify hardcoded secrets, insecure 'strdup' calls, and overly permissive file access rights (e.g., checking for 0600 permissions).
- Secure Memory Management: Implement advanced memory scrubbing techniques like 'explicit_bzero' and disable core dumps to prevent credentials from being recovered from volatile memory or system crashes.
- Leak Prevention in DevOps Pipelines: Establish guardrails to ensure secrets are never leaked into application logs, error messages, or passed insecurely to child processes via environment variables.
| name | security/secrets |
|---|---|
| description | Secrets Management security skill |
Secrets Management
API keys and credentials require careful handling throughout their lifecycle.
ikigai Application
API keys (OpenAI, Anthropic, etc.):
- Store in config file with
0600permissions - Load once at startup, hold in memory
- Never log, never include in error messages
- Never embed in source code or commits
Memory handling:
- Scrub secrets from memory when done:
explicit_bzero(key, len) - Avoid
strdup()for secrets (can't track copies) - Keep secret lifetime short and scoped
Config file security:
// Check permissions before reading
struct stat st;
if (stat(path, &st) == 0 && (st.st_mode & 077) != 0) {
return ERR(ctx, SECURITY, "Config file permissions too open");
}
Never expose:
- In logs or debug output
- In error messages shown to user
- In core dumps (
prctl(PR_SET_DUMPABLE, 0)) - Via environment to child processes
Review red flags: Secrets in printf/logging, strdup on credentials, missing permission checks.