{ "schema": "aiblocks-page/1", "id": "agency-security-secrets-credential-engineer", "type": "agent", "name": "Credential storage and rotation reviewer", "summary": "List where your secrets live. Get each one's risk, a rotation date and the storage fix, plus a leak-response runbook for when one gets out.", "headline": "Credential storage and rotation reviewer", "subhead": "List where your passwords, API keys and tokens live today, in code, config files or CI. It scores how exposed each one is, proposes a rotation schedule and a safer storage fix, and gives you the steps to run the moment one leaks.", "job": { "id": "secure-code", "name": "Keep your code secure" }, "level": "intermediate", "thinking": "high", "tested": true, "updated": "2026-11-03", "first_published": "2026-10-26", "inputs": [ { "type": "question", "required": true, "label": "Question", "what": "the problem, decision or piece of work you want help with, and what a good outcome looks like" }, { "type": "source_text", "required": false, "label": "Source text", "what": "a long source in full: an article, a video or talk transcript, or notes from a book, with its title, author and link" } ], "outputs": [ { "type": "audit_report", "required": true, "label": "Audit report", "what": "findings with evidence, severity, missing inputs and next actions" }, { "type": "plan", "required": true, "label": "Plan", "what": "a dated plan: what to do, in what order, with a decision rule for each step" } ], "you_give": [ "Where your secrets live today: which repos, config files, environment variables and CI systems hold them.", "The cloud or CI provider you use (AWS, Azure, GCP, GitHub Actions, and so on).", "How each credential is currently created and who or what uses it, as far as you know.", "Any secret scanner output you already have, such as from Gitleaks or GitHub secret scanning (optional)." ], "you_get": [ "A credential table: each secret's location, type, how it's stored, and its exposure risk.", "A rotation plan: which to rotate first, on what schedule, and the cutover steps that avoid an outage.", "A storage fix per credential: move to a vault, switch to a short-lived token, or scope it down.", "A leak-response runbook: the exact order to follow the moment a secret is exposed." ], "use_when": [ "You want to know which of your API keys, passwords and tokens are hardcoded, shared or never rotated.", "You're moving secrets out of code and .env files and into a vault or secrets manager, and want a migration order.", "A key just leaked (committed, logged or pasted somewhere it shouldn't be) and you need the response steps now.", "You're setting up secret scanning in CI and want to know what counts as a real finding versus noise." ], "skip_when": [ "A secret is leaking right now as part of an active, wider breach. Use the Security incident responder; this agent's leak-response steps are one part of that larger response, not a replacement for it.", "You want a one-time scan of a repo for exposed secrets, not a full inventory and rotation plan. Use the Exposed secrets finder.", "You want a lighter day-to-day habit check, not a structured engineering review. Use the Secret leak checker." ], "output_sample": { "input": [ "Where your secrets live: repos, config files, environment variables, CI", "Your cloud or CI provider", "How each credential is used today, as far as you know", "Existing secret scanner output (optional)" ], "prerequisites": [ "An AI that can read files, if you attach scanner output or config" ], "output": [ { "name": "Credential table", "contains": "Each secret's location, type, how it's stored and its exposure risk." }, { "name": "Rotation plan", "contains": "Rotation order, target dates, cutover steps and an owner for each credential." }, { "name": "Storage fixes", "contains": "A safer storage destination for each risky credential, sized small, medium or large." }, { "name": "Leak-response runbook", "contains": "The fixed order to follow the moment a secret is exposed, rotate first, then audit, then close the gap." }, { "name": "Assumptions and checks", "contains": "What the agent assumed and which facts you still need to confirm." } ] }, "output_shape": "CREDENTIAL TABLE\n | | | | \n\nROTATION PLAN (in order)\n | | | \n\nSTORAGE FIXES\n | | | \n\nLEAK-RESPONSE RUNBOOK\n 1. Rotate at the provider\n 2. Audit usage since exposure\n 3. Close the gap that let it through\n 4. Confirm no other secret shares the same root cause\n\nASSUMPTIONS AND CHECKS STILL NEEDED\n | ", "how_to_use": [ "Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.", "List where your secrets live: repos, .env files, CI variables, config, images, and which provider each one is for.", "Say how each credential is used today and by what, as far as you know.", "Say \"Build the inventory and rotation plan. Tell me which one to fix first.\"", "If a key already leaked, say so immediately and ask for the leak-response runbook first, before anything else.", "Work through the rotation plan oldest or most exposed first, and set an owner and date for each one." ], "checks": [ "The result addresses your actual task and cites the evidence used.", "Examples, role-play experience and targets are kept separate from verified results.", "Claims of tests, memory, tool access or completed actions match what actually happened." ], "next": [ { "name": "Privacy-first app designer", "url": "https://useaiblocks.com/skills/privacy-first-app-designer", "why": "Privacy-first app designer" } ], "source": { "by": "Michael Sitarzewski and Agency Agents contributors", "repo": "msitarzewski/agency-agents", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-secrets-credential-engineer.md", "licence": "MIT", "original_name": "Secrets & Credential Hygiene Engineer", "commit": "b37b5bb33b78f2c1d6567d98e25ca818e3259219" }, "credits": [ { "title": "Secrets & Credential Hygiene Engineer", "by": "Michael Sitarzewski and Agency Agents contributors", "url": "https://github.com/msitarzewski/agency-agents/blob/b37b5bb33b78f2c1d6567d98e25ca818e3259219/security/security-secrets-credential-engineer.md", "used": "Original agent profile, preserved in references/source-agent.md; AI Blocks adds setup and review instructions." } ], "files": [ "LICENSE", "references/source-agent.md", "SETUP.md", "source.json" ], "links": { "page": "https://useaiblocks.com/agents/agency-security-secrets-credential-engineer", "markdown": "https://useaiblocks.com/agents/agency-security-secrets-credential-engineer.md", "json": "https://useaiblocks.com/agents/agency-security-secrets-credential-engineer.json", "instructions": "https://useaiblocks.com/skills/agency-security-secrets-credential-engineer/SKILL.md", "download": "https://useaiblocks.com/skills/agency-security-secrets-credential-engineer.zip", "api_item": "https://useaiblocks.com/api/v1/items/agency-security-secrets-credential-engineer", "api_document": "https://useaiblocks.com/api/v1/documents/agent/agency-security-secrets-credential-engineer", "mcp": "https://useaiblocks.com/mcp" } }