Hire an AI credential storage and rotation reviewer

Everything it can hand back

Your task sets the actual outputs. The specialist picks the methods that cover them.

• A credential table: each secret's location, type, how it's stored, and its exposure risk.
• A rotation plan: which to rotate first, on what schedule, and the cutover steps that avoid an outage.
• A storage fix per credential: move to a vault, switch to a short-lived token, or scope it down.
• A leak-response runbook: the exact order to follow the moment a secret is exposed.

How it does the job well

• A leaked secret is burned the moment it's exposed. Never say a leak is "resolved" because the file was deleted or the commit was removed from the branch; it's resolved once the credential is rotated at the provider.
• Name the asset, the threat and the impact before recommending controls.
• Rank findings by real risk (likelihood and impact), with evidence for each.
• Prefer fixes that remove a problem over warnings that rely on people.
• Cite the exact law, standard or clause for compliance and legal points, and recommend qualified review.

Mistakes it avoids

• Treating file deletion or .gitignore as a fix for an already-committed secret. History still has it.
• Copying the profile's sample regex patterns or code snippets as if they described the user's actual codebase.
• Proposing a fix the named provider doesn't support (don't propose IRSA for a non-AWS setup).
• Long lists of generic issues with no evidence they apply.
• Testing or scanning systems without permission.
• Presenting a legal opinion as final.

What a good result looks like

An example, not your task: You want to know which of your API keys, passwords and tokens are hardcoded, shared or never rotated.

• Credential table. Each secret's location, type, how it's stored and its exposure risk.
• Rotation plan. Rotation order, target dates, cutover steps and an owner for each credential.
• Storage fixes. A safer storage destination for each risky credential, sized small, medium or large.
• Leak-response runbook. The fixed order to follow the moment a secret is exposed, rotate first, then audit, then close the gap.
• Assumptions and checks. What the agent assumed and which facts you still need to confirm.

How the work is checked

• Each finding has a location, evidence, severity and a specific fix.
• Likely false positives are checked and removed.
• Items that need a lawyer or auditor are clearly marked.
• States which checks passed, failed or could not run, and names missing inputs.

These checks have not been run against a model yet. Your AI uses them to check its own work.

Capabilities

• Build the inventory. It lists every secret location you gave it, with its type, how it's stored, and who or what uses it.
• Score exposure. Each credential is checked for hardcoding, excessive scope, missing rotation, and how long-lived it is when it could be short.
• Propose storage fixes. For each risky credential it proposes a destination (a vault, a secrets manager, a short-lived token) suited to the provider you named.
• Build the rotation plan. It orders rotation by risk, with an overlap period for each so cutover doesn't cause an outage.
• Write the leak-response runbook. It lays out the order for a real leak, rotate at the provider first, then audit usage, then close the gap that let it through.

How the role works

1. Checks your task, context and available tools.
2. Picks the methods needed and prepares a work plan.
3. Carries out supported tasks, with each method's limits and review gates.
4. Checks the real deliverables and corrects supported faults.
5. Hands back files, evidence and unresolved gaps.

Your specialist's working setup

Download the base specialist without a task form or account. README.md and SETUP.md explain how to use the folder. SOUL.md defines its scope. INTAKE.md asks missing questions inside your AI. PLAYBOOK.md, SKILLS.md, BEST_PRACTICES.md, CHECKS.md and HANDOFF.md guide the work and its checked deliverables.

Complete associated skills, supporting files and licences are included. Choose only the methods needed for the actual task. Keep context, working files and accepted feedback in your AI project.

Use this specialist through MCP or the API

Call prepare_specialist with role_id security-secrets-credential-engineer only. No task is required to load it. Your AI asks what job you need done, what you want back and which relevant context it can use.

For task-led hiring, call find_specialist, explain the suggested specialists and let the user accept or change the team.

Complete ZIP: Download base specialist. API: GET /api/v1/specialists/security-secrets-credential-engineer/pack. The host AI supplies its own model, tools and execution; a pack does not connect accounts or run a task.

Inputs and helpful context

The specialist starts from the task brief. Only active methods require their inputs.

For the primary method, when used

• Where your secrets live today: which repos, config files, environment variables and CI systems hold them.
• The cloud or CI provider you use (AWS, Azure, GCP, GitHub Actions, and so on).
• How each credential is currently created and who or what uses it, as far as you know.
• Any secret scanner output you already have, such as from Gitleaks or GitHub secret scanning (optional).

Helpful context (optional)

• Output from Gitleaks, TruffleHog or GitHub secret scanning.
• A list of who on your team has access to which credentials.
• Your vault or secrets manager, if you already use one.

Tools and access

• Claude, ChatGPT or Gemini with file upload: It can read a secret scanner's output or your CI config next to your own description.

Functions and deliverables

• Credential storage and rotation reviewer: List where your secrets live. Get each one's risk, a rotation date and the storage fix, plus a leak-response runbook for when one gets out.
  • A credential table: each secret's location, type, how it's stored, and its exposure risk.
  • A rotation plan: which to rotate first, on what schedule, and the cutover steps that avoid an outage.
  • A storage fix per credential: move to a vault, switch to a short-lived token, or scope it down.
  • A leak-response runbook: the exact order to follow the moment a secret is exposed.
  Source: Michael Sitarzewski and Agency Agents contributors.
• Credential setup planner: Get a secrets management plan for your CI/CD pipeline: how to store, read and rotate secrets in Vault, a cloud store or GitHub Actions.
  • A retrieval and access design
  • A rotation sequence with rollback
  • Log and artifact leak checks
  • A test list for denied and failed cases
  Source: sickn33.
• Site go-live runbook writer: Write a site go-live runbook with launch checks, DNS cutover steps, post-launch watching and a rollback plan. Give it your scope, window and team.
  • A pre-launch checklist
  • Go-live steps in order
  • DNS cutover steps
  • A post-launch watch plan
  • A rollback plan
  Source: RampStack.
• GitHub secret protection engineer: Get a step-by-step plan to turn on GitHub secret scanning and push protection, and to respond when a key leaks. Includes what needs a paid plan.
  • A plan with the exact settings to switch on, in order
  • A note on what is free and what needs a paid GitHub plan or Copilot
  • Steps for a blocked push, and for each kind of alert
  • A custom pattern or exclusion file, if you asked for one
  • A dated rotation table with blank owner and date for you to fill in
  Source: GitHub Copilot community.
• AI project context organiser: Share your project and next task. Get a short rules file, a focused file list and a clear handoff for later sessions.
  • A ready rules file for your project
  • A list of which files to load for each task
  • Rules for when to reset or trim the session
  • A checklist for spotting drifting answers
  Source: Addy Osmani.

Tasks you can use it for

• You want to know which of your API keys, passwords and tokens are hardcoded, shared or never rotated.
• You're moving secrets out of code and .env files and into a vault or secrets manager, and want a migration order.
• A key just leaked (committed, logged or pasted somewhere it shouldn't be) and you need the response steps now.
• You're setting up secret scanning in CI and want to know what counts as a real finding versus noise.

Limits to check before starting

• A secret is leaking right now as part of an active, wider breach. Use the Security incident responder; this agent's leak-response steps are one part of that larger response, not a replacement for it.
• You want a one-time scan of a repo for exposed secrets, not a full inventory and rotation plan. Use the Exposed secrets finder.
• You want a lighter day-to-day habit check, not a structured engineering review. Use the Secret leak checker.

Best way to use this role

Give it one clear outcome, the actual files and a definition of done. Keep the work in one AI project so it can reuse checked context and earlier files.

• Download the pack from this page and add it to your AI as a skill, or paste SKILL.md then references/source-agent.md into a new chat.
• List where your secrets live: repos, .env files, CI variables, config, images, and which provider each one is for.
• Say how each credential is used today and by what, as far as you know.
• Say "Build the inventory and rotation plan. Tell me which one to fix first."
• If a key already leaked, say so immediately and ask for the leak-response runbook first, before anything else.
• Work through the rotation plan oldest or most exposed first, and set an owner and date for each one.

Read it as data

Read the complete role setup as JSON. Connect your AI to the AI Blocks MCP library and read aiblocks://roles/security-secrets-credential-engineer for its role instructions and pinned sources.

This is a prepared AI role. No task has run. Your AI carries out authorized work using its available tools and reports the actual deliverables and checks.