hashicorp-vault
Assists with managing secrets, encryption keys, and dynamic credentials using HashiCorp Vault. Use when configuring secret engines, setting up dynamic database credentials, implementing access policies, integrating with Kubernetes, or using Transit for encryption as a service. Trigger words: vault, secrets management, dynamic secrets, transit engine, pki, approle, vault agent.
What this skill does
# HashiCorp Vault ## Overview HashiCorp Vault is a secrets management platform that provides KV storage with versioning, dynamic short-lived credentials for databases and cloud providers, PKI certificate management, Transit encryption as a service, and fine-grained HCL-based access policies. It integrates with Kubernetes via sidecar injection and CI/CD pipelines via AppRole authentication. ## Instructions - When storing static secrets, use the KV v2 engine with versioning for API keys and configuration values, organizing secrets by application and environment paths. - When managing database access, use the Database secret engine to generate dynamic, short-lived credentials that automatically expire, limiting the blast radius of credential leaks. - When authenticating applications, use AppRole for services and CI/CD (with secret_id rotation), Kubernetes auth for pods, and JWT/OIDC for SSO integration; never hardcode tokens. - When encrypting data, use the Transit engine for encryption as a service so applications encrypt/decrypt data without managing keys, with support for key rotation and convergent encryption. - When defining access, write HCL policies with deny-by-default, granting minimum capabilities (create, read, update, delete, list) per path, and use path templating for per-user isolation. - When deploying in Kubernetes, use Vault Agent sidecar injector or CSI provider to inject secrets into pods as files or environment variables, so applications read secrets without a Vault SDK. ## Examples ### Example 1: Set up dynamic database credentials for a microservice **User request:** "Configure Vault to issue short-lived PostgreSQL credentials for my API service" **Actions:** 1. Enable the Database secret engine and configure the PostgreSQL connection 2. Create a role with a SQL statement for read-only access and a 1-hour TTL 3. Set up AppRole authentication for the API service with a policy allowing `database/creds/readonly` 4. Configure Vault Agent sidecar to inject credentials into the pod and auto-renew leases **Output:** A microservice that receives dynamic database credentials with automatic rotation and a 1-hour expiry. ### Example 2: Add encryption as a service with Transit engine **User request:** "Encrypt sensitive user data at rest using Vault Transit without managing keys" **Actions:** 1. Enable the Transit secret engine and create a named encryption key 2. Build an API middleware that encrypts data via `transit/encrypt/key-name` before database writes 3. Add a decryption path that calls `transit/decrypt/key-name` on reads 4. Configure key rotation policy and verify old data remains decryptable **Output:** Application-level encryption using Vault Transit with automatic key management and rotation. ## Guidelines - Use dynamic secrets for databases since short-lived credentials limit the blast radius of a breach. - Use AppRole for services, never hardcoded tokens, since AppRole supports secret_id rotation. - Use Transit engine instead of application-level encryption since key management is Vault's responsibility. - Set TTLs as short as practical: 1 hour for database credentials and 15 minutes for CI tokens. - Enable audit device logging for compliance since it records who accessed what and when. - Use Vault Agent sidecar in Kubernetes so applications read secrets from files without needing a Vault SDK. - Store the root token securely and revoke it after initial setup; operators should use personal tokens.
Related in Cloud & DevOps
appbuilder-action-scaffolder
IncludedCreate, implement, deploy, and debug Adobe Runtime actions with consistent layout, validation, and error handling. Use this skill whenever the user needs to add actions to an App Builder project, understand action structure (params, response format, web/raw actions), configure actions in the manifest, use App Builder SDKs (State, Files, Events, database), deploy and invoke actions via CLI, debug action issues, or implement patterns such as webhook receivers, custom event providers, journaling consumers, large payload redirects, action sequence pipelines, and Asset Compute workers. Also trigger when users mention serverless functions in Adobe context, action logging, IMS authentication for actions, or cron-style scheduled actions.
orchestrating-datacloud
IncludedSalesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows. Use this skill when the user needs a multi-step Data Cloud pipeline, cross-phase troubleshooting, or data space and data kit management. TRIGGER when: user needs a multi-step Data Cloud pipeline, asks to set up or troubleshoot Data Cloud across phases, manages data spaces or data kits, or wants a cross-phase sf data360 workflow. DO NOT TRIGGER when: work is isolated to a single phase (use the matching phase-specific skill), the task is STDM/session tracing/parquet telemetry (use observing-agentforce), standard CRM SOQL (use querying-soql), or Apex implementation (use generating-apex).
github-project-automation
IncludedAutomate GitHub repository setup with CI/CD workflows, issue templates, Dependabot, and CodeQL security scanning. Includes 12 production-tested workflows and prevents 18 errors: YAML syntax, action pinning, and configuration. Use when: setting up GitHub Actions CI/CD, creating issue/PR templates, enabling Dependabot or CodeQL scanning, deploying to Cloudflare Workers, implementing matrix testing, or troubleshooting YAML indentation, action version pinning, secrets syntax, runner versions, or CodeQL configuration. Keywords: github actions, github workflow, ci/cd, issue templates, pull request templates, dependabot, codeql, security scanning, yaml syntax, github automation, repository setup, workflow templates, github actions matrix, secrets management, branch protection, codeowners, github projects, continuous integration, continuous deployment, workflow syntax error, action version pinning, runner version, github context, yaml indentation error
sf-datacloud
IncludedSalesforce Data Cloud product orchestrator for connect→prepare→harmonize→segment→act workflows. TRIGGER when: user needs a multi-step Data Cloud pipeline, asks to set up or troubleshoot Data Cloud across phases, manages data spaces or data kits, or wants a cross-phase `sf data360` workflow. DO NOT TRIGGER when: work is isolated to a single phase (use the matching sf-datacloud-* skill), the task is STDM/session tracing/parquet telemetry (use sf-ai-agentforce-observability), standard CRM SOQL (use sf-soql), or Apex implementation (use sf-apex).
fabric-cli
IncludedUse this skill for Fabric.so CLI workflows with the `fabric` terminal command: diagnose/install/login, search or browse a Fabric library, save notes/links/files, create folders, ask the Fabric AI assistant, manage tasks/workspaces, generate shell completion, check subscription usage, produce JSON output, and use Fabric as persistent agent memory. Do not use for Microsoft Fabric/Azure/Power BI `fab`, Daniel Miessler's Fabric framework, Python Fabric SSH, Fabric.js, or textile/fashion fabric.
lark
IncludedLark/Feishu CLI skills: lark-cli operations for docs, markdown, sheets, base, calendar, im, mail, task, okr, drive, wiki, slides, whiteboard, apps, approval, attendance, contact, vc, minutes, event. Use when the user needs to operate Lark/Feishu resources via lark-cli, send messages, manage documents, spreadsheets, calendars, tasks, OKRs, deploy web pages, or any Feishu/Lark workspace operations.