Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →ruvnet/harness-secrets
GCP Secret Manager integration: validate setup, fetch values, or confirm an NPM_TOKEN is non-revoked via `npm whoami`. Used for publish-time token rotation without long-lived keys in CI.
Passed 20 of 22 test cases with the skill, and 6 of 22 without it.
and 11 more in the full report
14 fixed6 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 14 test cases the skill fixed. Same model, same prompt, with and without the skill.
Check whether NPM_TOKEN_STAGING is revoked by testing it against the package index whoami endpoint.
| Checked | Without skill | With skill |
|---|---|---|
| Invokes validate-token mode passing NPM_TOKEN_STAGING as the secret target | Missed | Passed |
The instructions your model reads when the skill loads.
Codex skill for GCP Secret Manager — check / fetch / validate-token.
Validates the full GCP setup (gcloud on PATH, active project, auth principal, secret exists, WIF pool present). Use this when bootstrapping a new GCP project for publish.
/harness-secrets mode=check
/harness-secrets mode=check secret=NPM_TOKEN_DEV
/harness-secrets mode=check project=my-gcp-project secret=NPM_TOKEN
Fetches a secret value to stdout. Use in pipelines:
/harness-secrets mode=fetch secret=NPM_TOKEN
/harness-secrets mode=fetch secret=GH_TOKEN version=3
Fetches NPM_TOKEN and runs npm whoami against the registry. No publish — just confirms the token isn't revoked. Use this BEFORE you tag a release.
/harness-secrets mode=validate-token
/harness-secrets mode=validate-token secret=NPM_TOKEN_STAGING
harness secrets check --secret=NPM_TOKEN
harness secrets fetch NPM_TOKEN --version=3
harness secrets validate-token
test cases passed, vs 6 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.