secrets-with-git-crypt

Name: secrets-with-git-crypt
Author: derailed-dash

33installs1forks

How to install secrets-with-git-crypt?

derailed-dash/dazbo-agent-skills/secrets-with-git-crypt

$npx -y skills add derailed-dash/dazbo-agent-skills --skill secrets-with-git-crypt

Installs into the current project.

Summary

Use when managing encryption and decryption of secrets (like .env or *.tfvars) using git-crypt. Helps install git-crypt, initialize/unlock repositories, and maintain parallel unencrypted/encrypted file copies securely.

Files · 1

View on GitHub

SKILL.md

1	# Secrets Management with Git-Crypt
2
3	This skill provides a secure, structured workflow for managing repository secrets (e.g. `.env`, `*.tfvars`, `sec.json`, `settings.json`) using `git-crypt`. It guides the agent to ensure sensitive credentials are never checked in as plaintext, instead maintaining parallel encrypted `.enc` versions checked into Git.
4
5	## Table of Contents
6
7	- [Triggers](#triggers)
8	- [Prerequisites](#prerequisites)
9	- [Secrets Setup and Sync Workflow](#secrets-setup-and-sync-workflow)
10	- [Command Reference](#command-reference)
11	- [Verification Loop](#verification-loop)
12
13	## Triggers
14
15	This skill MUST trigger whenever:
16
17	- The user mentions `git-crypt`, `encryption`, `decryption`, or `secrets management`.
18	- The user requests to store sensitive files (like `.env`, `*.tfvars`, `settings.json`, keyfiles) in the repository.
19	- The user attempts to commit or push files that should be encrypted (e.g. `.env`, `*.tfvars`, `sec.json`) to the repository.
20	- Cloning an existing repository that contains `.enc` files (e.g. `.env.enc`, `terraform.tfvars.enc`, `settings.json.enc`), indicating it was previously protected by git-crypt.
21	- Initializing a new repository and setting up local/remote secret configurations.
22	- Changing or adding secrets credentials that need to be committed securely.
23
24	## Prerequisites
25
26	- Host Environment: Unix-like operating system (e.g., Linux, WSL, macOS).
27	- Git: A git repository must be initialized in the current project.
28	- git-crypt: The `git-crypt` command-line utility must be installed.
29	- If missing, the helper script can attempt installation via `sudo apt-get install git-crypt` on Debian/Ubuntu systems.
30	- Helper Script: Make sure the helper script at `skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh` is executable (`chmod +x`).
31
32	## Secrets Setup and Sync Workflow
33
34	Copy this checklist and track your progress:
35
36	```
37	Secrets Management Progress:
38	- [ ] Step 1: Verify git-crypt installation
39	- [ ] Step 2: Initialize or unlock the repository
40	- [ ] Step 3: Configure tracking and gitignore rules
41	- [ ] Step 4: Perform file synchronization
42	- [ ] Step 5: Verify environment security
43	```
44
45	Step 1: Verify git-crypt installation
46
47	Run the status command of the helper script to check if git-crypt is available on the system:
48	```bash
49	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh status
50	```
51	If it is not installed, run the installation helper command:
52	```bash
53	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh install
54	```
55
56	Step 2: Initialize or unlock the repository
57
58	- If this is a new repository (or you are setting up git-crypt for the first time):
59	Decide where the secure key will be stored outside of the repository (e.g., `~/secure-keys/my-project.key`). Proactively run:
60	```bash
61	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh init ~/secure-keys/my-project.key
62	```
63	Ensure the key is NEVER committed to git.
64
65	- If this is a cloned repository containing `.enc` files:
66	Ask the user for the local path to the existing key file, and run:
67	```bash
68	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh unlock /path/to/existing.key
69	```
70
71	Step 3: Configure tracking and gitignore rules
72
73	Verify that `.gitattributes` in the root of the project contains the filter declaration:
74	```text
75	*.enc filter=git-crypt diff=git-crypt
76	```
77	All unencrypted files (e.g. `.env`, `settings.json`, `variables.tfvars`) MUST be explicitly added to `.gitignore`. Running the helper script sync commands automatically appends them, but you must double-check that they are not tracked as plaintext in Git.
78
79	Step 4: Perform file synchronization
80
81	- Sync to encrypted versions (before committing changes):
82	Copy unencrypted local files to their parallel `.enc` versions:
83	- For a specific file:
84	```bash
85	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh sync-to-enc .env
86	```
87	- For all known `.enc` files in the repository:
88	```bash
89	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh sync-to-enc
90	```
91
92	- Sync from encrypted versions (after unlocking a cloned repository):
93	Restore all unencrypted plaintext files from the unlocked `.enc` versions:
94	```bash
95	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh sync-from-enc
96	```
97
98	Step 5: Verify environment security
99
100	Perform the steps in the [Verification Loop](#verification-loop) before concluding your turn to make sure no plaintext secrets have been staged or committed.
101
102	---
103
104	## Command Reference
105
106	The helper script supports the following commands:
107
108	\| Command \| Arguments \| Description \|
109	\| :--- \| :--- \| :--- \|
110	\| `install` \| None \| Installs

People who liked this also viewed

6 picks

Type

secrets-with-git-crypt

33installs1forks

View on GitHub

How to install secrets-with-git-crypt?

derailed-dash/dazbo-agent-skills/secrets-with-git-crypt

$npx -y skills add derailed-dash/dazbo-agent-skills --skill secrets-with-git-crypt

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Secrets Management with Git-Crypt
2
3	This skill provides a secure, structured workflow for managing repository secrets (e.g. `.env`, `*.tfvars`, `sec.json`, `settings.json`) using `git-crypt`. It guides the agent to ensure sensitive credentials are never checked in as plaintext, instead maintaining parallel encrypted `.enc` versions checked into Git.
4
5	## Table of Contents
6
7	- [Triggers](#triggers)
8	- [Prerequisites](#prerequisites)
9	- [Secrets Setup and Sync Workflow](#secrets-setup-and-sync-workflow)
10	- [Command Reference](#command-reference)
11	- [Verification Loop](#verification-loop)
12
13	## Triggers
14
15	This skill MUST trigger whenever:
16
17	- The user mentions `git-crypt`, `encryption`, `decryption`, or `secrets management`.
18	- The user requests to store sensitive files (like `.env`, `*.tfvars`, `settings.json`, keyfiles) in the repository.
19	- The user attempts to commit or push files that should be encrypted (e.g. `.env`, `*.tfvars`, `sec.json`) to the repository.
20	- Cloning an existing repository that contains `.enc` files (e.g. `.env.enc`, `terraform.tfvars.enc`, `settings.json.enc`), indicating it was previously protected by git-crypt.
21	- Initializing a new repository and setting up local/remote secret configurations.
22	- Changing or adding secrets credentials that need to be committed securely.
23
24	## Prerequisites
25
26	- Host Environment: Unix-like operating system (e.g., Linux, WSL, macOS).
27	- Git: A git repository must be initialized in the current project.
28	- git-crypt: The `git-crypt` command-line utility must be installed.
29	- If missing, the helper script can attempt installation via `sudo apt-get install git-crypt` on Debian/Ubuntu systems.
30	- Helper Script: Make sure the helper script at `skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh` is executable (`chmod +x`).
31
32	## Secrets Setup and Sync Workflow
33
34	Copy this checklist and track your progress:
35
36	```
37	Secrets Management Progress:
38	- [ ] Step 1: Verify git-crypt installation
39	- [ ] Step 2: Initialize or unlock the repository
40	- [ ] Step 3: Configure tracking and gitignore rules
41	- [ ] Step 4: Perform file synchronization
42	- [ ] Step 5: Verify environment security
43	```
44
45	Step 1: Verify git-crypt installation
46
47	Run the status command of the helper script to check if git-crypt is available on the system:
48	```bash
49	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh status
50	```
51	If it is not installed, run the installation helper command:
52	```bash
53	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh install
54	```
55
56	Step 2: Initialize or unlock the repository
57
58	- If this is a new repository (or you are setting up git-crypt for the first time):
59	Decide where the secure key will be stored outside of the repository (e.g., `~/secure-keys/my-project.key`). Proactively run:
60	```bash
61	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh init ~/secure-keys/my-project.key
62	```
63	Ensure the key is NEVER committed to git.
64
65	- If this is a cloned repository containing `.enc` files:
66	Ask the user for the local path to the existing key file, and run:
67	```bash
68	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh unlock /path/to/existing.key
69	```
70
71	Step 3: Configure tracking and gitignore rules
72
73	Verify that `.gitattributes` in the root of the project contains the filter declaration:
74	```text
75	*.enc filter=git-crypt diff=git-crypt
76	```
77	All unencrypted files (e.g. `.env`, `settings.json`, `variables.tfvars`) MUST be explicitly added to `.gitignore`. Running the helper script sync commands automatically appends them, but you must double-check that they are not tracked as plaintext in Git.
78
79	Step 4: Perform file synchronization
80
81	- Sync to encrypted versions (before committing changes):
82	Copy unencrypted local files to their parallel `.enc` versions:
83	- For a specific file:
84	```bash
85	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh sync-to-enc .env
86	```
87	- For all known `.enc` files in the repository:
88	```bash
89	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh sync-to-enc
90	```
91
92	- Sync from encrypted versions (after unlocking a cloned repository):
93	Restore all unencrypted plaintext files from the unlocked `.enc` versions:
94	```bash
95	./skills/secrets-with-git-crypt/scripts/git-crypt-helper.sh sync-from-enc
96	```
97
98	Step 5: Verify environment security
99
100	Perform the steps in the [Verification Loop](#verification-loop) before concluding your turn to make sure no plaintext secrets have been staged or committed.
101
102	---
103
104	## Command Reference
105
106	The helper script supports the following commands:
107
108	\| Command \| Arguments \| Description \|
109	\| :--- \| :--- \| :--- \|
110	\| `install` \| None \| Installs

People who liked this also viewed

6 picks

Type