Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →Integrate secrets management (Vault, AWS, Azure, GCP) with rotation policies, access controls, and Kubernetes/CI/CD application integration.
.claude/skills/williamzujkowski-secrets-management-integrator/SKILL.md| Test case | Without → With | Effect | Δ tokens | Δ turns |
|---|---|---|---|---|
| case-01 | ✗→✓ | ▲ Improved | 23% | 0% |
| case-02 | ✗→✓ | ▲ Improved | 11% | 0% |
| case-03 | ✗→✓ | ▲ Improved | 16% | 0% |
| case-07 | ✗→✓ | ▲ Improved | 110% | 0% |
| case-08 | ✗→✓ | ▲ Improved | 120% | 0% |
Trigger conditions:
Not for:
Time normalization:
NOW_ET using NIST/time.gov semantics (America/New_York, ISO-8601): 2025-10-26T02:31:21-04:00NOW_ET for all citation access datesInput validation:
secrets_backend must be one of: vault, aws-secrets, azure-keyvault, gcp-secretmanager]integration_target must be one of: kubernetes, cicd, application]rotation_policy must be one of: manual, automatic, dynamic]credential_type provided, must be one of: database, api-key, certificate, generic]Source freshness:
HashiCorp Vault:
AWS Secrets Manager:
Azure Key Vault:
GCP Secret Manager:
Automatic Rotation (AWS Secrets Manager):
Dynamic Credentials (Vault Database Engine):
Access Policies:
Audit Logging:
Kubernetes Integration (External Secrets Operator):
CI/CD Integration:
Application SDK Usage:
hvac (Vault), boto3 (AWS), azure-keyvault-secrets, google-cloud-secret-managernode-vault, AWS SDK v3, @azure/keyvault-secrets, @google-cloud/secret-managerCertificate Management:
Token budgets:
Backend Selection:
Rotation Policy:
Abort Conditions:
Ambiguity Thresholds:
Required fields:
json{ "secrets_backend": "vault|aws-secrets|azure-keyvault|gcp-secretmanager", "integration_target": "kubernetes|cicd|application", "rotation_policy": "manual|automatic|dynamic", "credential_type": "database|api-key|certificate|generic", "timestamp": "ISO-8601 with timezone", "secrets_config": { "backend_endpoint": "https://vault.example.com:8200 or AWS region", "authentication_method": "kubernetes|approle|iam|managed-identity|workload-identity", "secret_path": "logical path or ARN", "config_file": "HCL, JSON, or YAML configuration" }, "access_policies": { "policy_name": "application-secrets-reader", "policy_type": "vault-policy|iam-policy|rbac-assignment|iam-binding", "policy_document": "HCL, JSON, or YAML policy definition", "scope": "path or resource ARN" }, "integration_code": { "language": "python|go|nodejs|java", "sdk_version": "library version (e.g., hvac==2.1.0)", "authentication_snippet": "code for backend authentication", "secret_retrieval_snippet": "code for fetching secret", "error_handling": "retry logic and fallback strategy" }, "rotation_scripts": { "rotation_type": "lambda|cloud-function|cronjob|vault-engine", "schedule": "cron expression or TTL", "rotation_logic": "code or configuration for rotation", "notification": "SNS, Pub/Sub, or webhook for rotation events" }, "deployment_manifests": [ { "type": "kubernetes|terraform|cloudformation", "filename": "external-secret.yaml or main.tf", "content": "manifest or IaC code" } ] }
Example: Vault + Kubernetes External Secrets
yaml# Input: vault backend, kubernetes target, dynamic rotation # Output: ExternalSecret for PostgreSQL dynamic credentials apiVersion: external-secrets.io/v1beta1 kind: SecretStore metadata: name: vault-backend spec: provider: vault: server: "https://vault.example.com:8200" auth: kubernetes: role: "production-app" --- apiVersion: external-secrets.io/v1beta1 kind: ExternalSecret metadata: name: postgres-creds spec: refreshInterval: 1h secretStoreRef: name: vault-backend data: - secretKey: username remoteRef: key: database/creds/postgres-prod - secretKey: password remoteRef: key: database/creds/postgres-prod
Token budgets:
Safety:
Auditability:
Determinism:
HashiCorp Vault:
AWS Secrets Manager:
Azure Key Vault:
GCP Secret Manager:
Kubernetes Integration:
Security Best Practices:
| Case | Status | Duration (ms) | Turns | Tokens | Tool calls | ||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Without | With | Δ | Without | With | Δ | Without | With | Δ | Without | With | Δ | ||
case-01 | fail→pass | 22,864 | 11,901 | -48% | 1 | 1 | 0% | 5,122 | 6,295 | +23% | 0 | 0 | — |
case-02 | fail→pass | 24,336 | 11,836 | -51% | 1 | 1 | 0% | 5,801 | 6,450 | +11% | 0 | 0 | — |
case-03 | fail→pass | 28,271 | 17,692 | -37% | 1 | 1 | 0% | 6,254 | 7,266 | +16% | 0 | 0 | — |
case-04 | pass→pass | 13,886 | 11,645 | -16% | 1 | 1 | 0% | 2,286 | 5,552 | +143% | 0 | 0 | — |
case-05 | pass→pass | 11,165 | 7,450 | -33% | 1 | 1 | 0% | 2,162 | 4,731 | +119% | 0 | 0 | — |
case-06 | pass→pass | 16,309 | 13,806 | -15% | 1 | 1 | 0% | 2,944 | 6,079 | +106% | 0 | 0 | — |
case-07 | fail→pass | 13,400 | 12,669 | -5% | 1 | 1 | 0% | 3,092 | 6,490 | +110% | 0 | 0 | — |
case-08 | fail→pass | 11,725 | 12,090 | +3% | 1 | 1 | 0% | 2,838 | 6,252 | +120% | 0 | 0 | — |
case-09 | fail→pass | 10,927 | 9,445 | -14% | 1 | 1 | 0% | 2,501 | 5,601 | +124% | 0 | 0 | — |
case-10 | fail→pass | 17,222 | 11,856 | -31% | 1 | 1 | 0% | 4,448 | 6,245 | +40% | 0 | 0 | — |
case-11 | fail→pass | 12,844 | 18,107 | +41% | 1 | 1 | 0% | 2,364 | 5,889 | +149% | 0 | 0 | — |
case-12 | fail→pass | 31,423 | 12,046 | -62% | 1 | 1 | 0% | 2,872 | 6,321 | +120% | 0 | 0 | — |
case-13 | fail→fail | 16,089 | 10,382 | -35% | 1 | 1 | 0% | 4,236 | 5,936 | +40% | 0 | 0 | — |
case-14 | fail→pass | 8,974 | 8,588 | -4% | 1 | 1 | 0% | 1,981 | 5,654 | +185% | 0 | 0 | — |
case-15 | fail→pass | 6,355 | 11,525 | +81% | 1 | 1 | 0% | 1,499 | 6,342 | +323% | 0 | 0 | — |
case-16 | fail→pass | 5,588 | 8,894 | +59% | 1 | 1 | 0% | 1,124 | 5,644 | +402% | 0 | 0 | — |
case-17 | fail→pass | 7,775 | 10,309 | +33% | 1 | 1 | 0% | 1,689 | 5,837 | +246% | 0 | 0 | — |
case-18 | fail→pass | 7,232 | 12,233 | +69% | 1 | 1 | 0% | 1,520 | 6,172 | +306% | 0 | 0 | — |
case-19 | fail→pass | 5,408 | 7,957 | +47% | 1 | 1 | 0% | 1,086 | 5,285 | +387% | 0 | 0 | — |
case-20 | fail→pass | 13,729 | 9,105 | -34% | 1 | 1 | 0% | 2,814 | 5,624 | +100% | 0 | 0 | — |
case-21 | pass→pass | 9,108 | 8,650 | -5% | 1 | 1 | 0% | 2,165 | 5,551 | +156% | 0 | 0 | — |
case-22 | fail→pass | 6,099 | 7,225 | +18% | 1 | 1 | 0% | 1,202 | 5,036 | +319% | 0 | 0 | — |
DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +77 percentage points is the difference between those two pass rates over the 22 comparable cases.
Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.
Other measured skills in the registry, with their headline benchmark lift.