validate-secrets

piotrb's avatarfrom piotrb

Validate SOPS encryption on secret files before committing. Use when staging secrets, committing encrypted files, or checking if secrets are properly encrypted. Prevents committing unencrypted secrets.

⭐0stars🔀0forks📁View on GitHub🕐Updated Dec 26, 2025
[Security Operations]

When & Why to Use This Skill

This Claude skill acts as a critical security guardrail by validating SOPS encryption on sensitive files before they are committed to version control. It automatically identifies potential secret leaks by scanning file patterns and verifying SOPS metadata, ensuring that credentials and sensitive configurations remain encrypted and protected against accidental exposure.

Use Cases

  • Pre-commit Validation: Automatically check staged files for sensitive patterns (e.g., *.sops.yaml, secrets/*.yaml) to ensure they are properly encrypted before a git commit is finalized.
  • CI/CD Pipeline Security: Integrate as a mandatory check in automated workflows to prevent unencrypted secrets from being merged into the main branch or deployed to production.
  • Repository Auditing: Scan existing project directories to identify files that match secret naming conventions but lack the required SOPS metadata, helping to clean up legacy security risks.
  • Developer Workflow Assistance: Provide immediate feedback and manual encryption instructions to developers when unencrypted secrets are detected, promoting secure coding practices.
namevalidate-secrets
descriptionValidate SOPS encryption on secret files before committing. Use when staging secrets, committing encrypted files, or checking if secrets are properly encrypted. Prevents committing unencrypted secrets.
allowed-toolsBash Read Grep Glob

Validate Secrets

Ensure secret files are properly SOPS-encrypted before commit.

For SOPS configuration and encryption details, see reference.md.

Instructions

  1. Identify files matching secret patterns in staged/modified files
  2. Check if files are SOPS-encrypted (look for sops: metadata)
  3. Report any unencrypted secrets that should be encrypted
  4. Block commit recommendation if unencrypted secrets found
  5. DO NOT automatically run sops --encrypt or sops --decrypt commands - inform the user to run these manually

Secret File Patterns

Files that MUST be encrypted:

Pattern Description
*.sops.yaml SOPS encrypted files
*sopssecret*.yaml SopsSecret CRDs
*/secrets/*.yaml Files in secrets directories
*secret*.yaml Files with "secret" in name

Validation Check

A file is SOPS-encrypted if it contains:

sops:
    kms: []
    age:
        - recipient: age1...

Or for SopsSecret CRDs:

kind: SopsSecret
spec:
    secretTemplates:
        ...
sops:
    ...

Output

Safe to commit:

  • List encrypted files that passed validation

BLOCKED - Unencrypted secrets found:

  • List files that match secret patterns but lack SOPS encryption
  • Inform user to manually encrypt: sops --encrypt --in-place <file>
  • DO NOT run the encryption command automatically

Integration

This skill is called by commit-workflow before staging secret files.