agentskills.codes
SE

secrets-sync

by SymbionicNigelSecuritySource

Manage and sync project secrets via chezmoi, GPG, and Bitwarden workflows.

Security AuditGitAutomation

Install

mkdir -p .claude/skills/secrets-sync && curl -L -o skill.zip "https://agentskills.codes/api/skills/download/12092" && unzip -o skill.zip -d .claude/skills/secrets-sync && rm skill.zip

Installs to .claude/skills/secrets-sync

Activation

This is the description your AI agent reads to decide when to run this skill — the better it matches your request, the more reliably it fires.

Use when the user adds, edits, lists, or applies chezmoi-managed secrets; syncs Bitwarden sessions; runs GPG encryption on project files; or works with the .secrets submodule. Also use when troubleshooting chezmoi config path issues in this repository.
252 chars✓ has a “when” triggerlonger than Claude Code's old 250-char listing cap (fine on current versions)
Intermediate

Key capabilities

  • →Add new secrets to chezmoi
  • →Edit existing chezmoi-managed secrets
  • →List files managed by chezmoi
  • →Apply secrets to the project root
  • →Check differences in chezmoi-managed files
  • →Source Bitwarden sessions

How it works

The skill uses chezmoi commands with a project-local configuration to manage secrets, handling tasks like adding, editing, and applying them. It also integrates with Bitwarden for session management and GPG for encryption.

Inputs & outputs

You give it
A path to a secret file
You get back
An encrypted secret added to chezmoi

When to use secrets-sync

  • →Add new encrypted secret
  • →Apply secrets to local config
  • →Sync Bitwarden session

About this skill

secrets-sync

All chezmoi commands in this repo require --config ./.chezmoi.toml because the config is project-local, not in ~/.config/chezmoi.

Source-of-Truth Chain

digraph secrets {
  rankdir=LR;
  node [shape=box];
  "Bitwarden" -> ".env.bitwarden" -> "chezmoi templates\n(.secrets/)";
  "chezmoi templates\n(.secrets/)" -> "chezmoi apply" [shape=plaintext];
  "chezmoi apply" -> "target files\n(project root)";
}

Quick Reference

OperationCommand
Add new secret./dotfile-utils/scripts/chezmoi-add-secret.sh [--encrypt] <path>
Edit existing secretEdit file in place, then chezmoi --config ./.chezmoi.toml merge <path> to sync back to source
List managed fileschezmoi --config ./.chezmoi.toml managed
Apply secretschezmoi --config ./.chezmoi.toml apply
Check diffchezmoi --config ./.chezmoi.toml diff
Source Bitwardensource ./dotfile-utils/scripts/source_bitwarden_session.sh
Stage in submodulechezmoi --config ./.chezmoi.toml git -- add <chezmoi-path>

Workflow

  1. Determine operation: add / edit / list / apply
  2. If working with encrypted or Bitwarden-templated secrets, source the Bitwarden session first (auto-sourced by helper script when .env.bitwarden exists or BW_SESSION is set)
  3. Run the correct command from the table above
  4. Verify with managed or diff
  5. Stage changes inside .secrets submodule
  6. Remind user to commit the updated submodule pointer in the parent repo

Key Facts

  • Config flag required: Every chezmoi invocation needs --config ./.chezmoi.toml
  • GPG key ID: 9A4ABBA2F90BCF19
  • .secrets is a git submodule -- changing files inside it means the parent repo sees a dirty submodule pointer that must also be committed
  • chezmoi-add-secret.sh handles dot-prefix conversion (.env -> dot_env) and encrypted_ prefix automatically; it also auto-sources Bitwarden if .env.bitwarden exists
  • Source dir: .secrets/ (set via sourceDir in .chezmoi.toml)
  • Dest dir: project root . (set via destDir in .chezmoi.toml)

Common Mistakes

  • Running bare chezmoi without --config ./.chezmoi.toml (will use ~/.config/chezmoi and operate on the wrong source)
  • Forgetting to commit the submodule pointer in the parent repo after changing .secrets
  • Using chezmoi add directly instead of chezmoi-add-secret.sh for project files (chezmoi refuses to add files from its own dest dir)

When not to use it

  • →When not working with chezmoi-managed secrets
  • →When not using GPG encryption for project files
  • →When not working with the .secrets submodule

Limitations

  • →Requires `--config ./.chezmoi.toml` for all chezmoi invocations
  • →Changes inside the `.secrets` submodule require committing the updated submodule pointer in the parent repo
  • →Cannot use `chezmoi add` directly for project files

How it compares

This skill automates chezmoi operations with a specific project configuration and Bitwarden integration, unlike manual chezmoi usage that requires explicit config flags and separate Bitwarden session sourcing.

Compared to similar skills

secrets-sync side by side with the closest alternatives in the catalog.

SkillInstallsUpdatedSafetyDifficulty
secrets-sync (this skill)03moReviewIntermediate
prowler-ci16moNo flagsIntermediate
1password272moReviewIntermediate
senior-security317moReviewAdvanced

Try saying

Example prompts that trigger this skill in your AI assistant.

You might also like

prowler-ci

prowler-cloud

Helps with Prowler repository CI and PR gates (GitHub Actions workflows). Trigger: When investigating CI checks failing on a PR, PR title validation, changelog gate/no-changelog label, conflict marker checks, secret scanning, CODEOWNERS/labeler automation, or anything under .github/workflows.

10

1password

openclaw

Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.

2799

senior-security

davila7

Comprehensive security engineering skill for application security, penetration testing, security architecture, and compliance auditing. Includes security assessment tools, threat modeling, crypto implementation, and security automation. Use when designing security architecture, conducting penetration tests, implementing cryptography, or performing security audits.

3191

fix-dependabot-alerts

microsoft

Fix Dependabot security alerts by updating vulnerable npm dependencies. Use when the user mentions "dependabot", "security alerts", "vulnerability", "CVE", or wants to update packages with security issues.

1872

red-team-tools-and-methodology

davila7

This skill should be used when the user asks to "follow red team methodology", "perform bug bounty hunting", "automate reconnaissance", "hunt for XSS vulnerabilities", "enumerate subdomains", or needs security researcher techniques and tool configurations from top bug bounty hunters.

759

security-ownership-map

openai

Analyze git repositories to build a security ownership topology (people-to-file), compute bus factor and sensitive-code ownership, and export CSV/JSON for graph databases and visualization. Trigger only when the user explicitly wants a security-oriented ownership or bus-factor analysis grounded in git history (for example: orphaned sensitive code, security maintainers, CODEOWNERS reality checks for risk, sensitive hotspots, or ownership clusters). Do not trigger for general maintainer lists or non-security ownership questions.

214

Search skills

Search the agent skills registry