lictor-rotate

Name: lictor-rotate
Author: Raffa-jarrl

15stars3forks

How to install lictor-rotate?

raffa-jarrl/lictor-ai/lictor-rotate

$npx -y skills add Raffa-jarrl/Lictor-AI --skill lictor-rotate

Installs into the current project.

Summary

Walks the user through rotating a leaked API key — step by step, provider-specific. Knows the exact URL to visit, the exact button to click, and how to verify the rotation worked. Supports Stripe, OpenAI, Anthropic, Google Cloud / AI Studio, GitHub, AWS, Slack, Supabase, Firebase

Files · 1

View on GitHub

SKILL.md

1	# Lictor Rotate — guided key rotation
2
3	A key got leaked. The user needs to rotate it. You walk them through
4	the exact steps for their specific provider, without making them dig
5	through documentation.
6
7	## How invocation works
8
9	The user typed `/lictor-rotate` (with or without a provider name). Three
10	shapes:
11
12	1. `/lictor-rotate` alone — ask which provider
13	2. `/lictor-rotate stripe` — go straight to the Stripe runbook
14	3. `/lictor-rotate openai sk-...` — they pasted the leaked key
15
16	If a key string is pasted into the chat: redact it in your reply.
17	Don't echo `sk_live_AAAA...EFGH` back at them. Say "your `sk_live_*...
18	EFGH` key" using only the prefix and last 4 chars. The full key
19	shouldn't end up in chat logs more times than necessary.
20
21	## What you do (general flow)
22
23	1. Confirm urgency. Is the key already in a public repo or a deployed
24	site? If yes, this is "do it in the next hour" urgent. If no (e.g.
25	they found it in a private repo and want to clean up), it's "do it
26	today" urgent.
27	2. Walk them through the provider's rotation flow. Use the
28	provider-specific runbook below. Be specific: the exact URL, the
29	exact button label.
30	3. Tell them what to do with the new key. Replace the old key in
31	their `.env`, restart their dev server, redeploy.
32	4. Help them check for damage. Some providers (Stripe, OpenAI)
33	have usage logs they should review for unauthorized activity.
34	5. Confirm the old key is dead. Most providers let you test by
35	trying to use the old key — it should return 401.
36
37	## Provider runbooks
38
39	### Stripe
40
41	1. Open https://dashboard.stripe.com/apikeys
42	2. Find the live secret key (starts with `sk_live_`) — match on the
43	prefix the user gave you
44	3. Click the `···` menu next to it → Roll key
45	4. Stripe asks: "How long should the old key remain active?" Pick **0
46	seconds** (immediate revocation) unless they have automated systems
47	they need to update first
48	5. Stripe shows the new key once — copy it now, you can't see it again
49	6. Where to put the new key:
50	- `.env.local` (or `.env.production` for deployed environment)
51	- Variable name: `STRIPE_SECRET_KEY` (or whatever they used)
52	- Restart their dev server
53	- Redeploy to production (Vercel/Netlify environment variables UI)
54	7. Check for damage:
55	- https://dashboard.stripe.com/payments — look for charges you don't
56	recognize since the leak
57	- https://dashboard.stripe.com/logs — API requests; look for IPs you
58	don't recognize
59	8. Verify rotation worked: try the old key with `curl
60	https://api.stripe.com/v1/charges -u <OLD_KEY>:` — should return 401
61	Unauthorized
62
63	### OpenAI
64
65	1. Open https://platform.openai.com/api-keys
66	2. Find the key that starts with `sk-` matching the prefix
67	3. Click `···` → Revoke key (yes, revoke — not "rotate")
68	4. Click + Create new secret key at the top
69	5. Name it the same as the old one (e.g. "production")
70	6. Copy the new key (only shown once)
71	7. Where to put it:
72	- `.env.local`, variable name `OPENAI_API_KEY`
73	- Restart the dev server
74	- Redeploy
75	8. Check for damage:
76	- https://platform.openai.com/usage — look at the last 7 days for
77	unexpected spikes
78	- https://platform.openai.com/account/limits — confirm spending
79	caps are reasonable; if not, lower them
80	9. Verify rotation: the old key returns 401 immediately on revoke
81
82	### Anthropic
83
84	1. Open https://console.anthropic.com/settings/keys
85	2. Find the key matching prefix (`sk-ant-api03-...`)
86	3. Click · menu → Delete key
87	4. Click + Create Key at the top right
88	5. Copy the new key
89	6. Where to put it:
90	- `.env.local`, variable name `ANTHROPIC_API_KEY`
91	- Restart, redeploy
92	7. Check for damage:
93	- https://console.anthropic.com/settings/usage — last 7 days
94	8. Verify: old key returns 401
95
96	### Google API key (Google Cloud / AI Studio)
97
98	1. For Google AI Studio keys (start with `AIza...`):
99	- Open https://aistudio.google.com/app/apikey
100	- Find the key, click the delete icon
101	- Click Create API key for a new one
102	2. For Google Cloud Platform keys:
103	- Open https://console.cloud.google.com/apis/credentials
104	- Find the API key in the list, click it
105	- Click Delete, then Create credentials → API key
106	- Restrict the new key — under "Application restrictions," limit
107	to specific domains or IPs. Under "API restrictions," limit to
108	only the APIs you actually use.
109	3. Where to put it: `.env.local`, redeploy
110	4. Check for damage: https://console.cloud.google.com/billing —
111	recen

People who liked this also viewed

6 picks

Type

lictor-rotate

15stars3forks

View on GitHub

How to install lictor-rotate?

raffa-jarrl/lictor-ai/lictor-rotate

$npx -y skills add Raffa-jarrl/Lictor-AI --skill lictor-rotate

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Lictor Rotate — guided key rotation
2
3	A key got leaked. The user needs to rotate it. You walk them through
4	the exact steps for their specific provider, without making them dig
5	through documentation.
6
7	## How invocation works
8
9	The user typed `/lictor-rotate` (with or without a provider name). Three
10	shapes:
11
12	1. `/lictor-rotate` alone — ask which provider
13	2. `/lictor-rotate stripe` — go straight to the Stripe runbook
14	3. `/lictor-rotate openai sk-...` — they pasted the leaked key
15
16	If a key string is pasted into the chat: redact it in your reply.
17	Don't echo `sk_live_AAAA...EFGH` back at them. Say "your `sk_live_*...
18	EFGH` key" using only the prefix and last 4 chars. The full key
19	shouldn't end up in chat logs more times than necessary.
20
21	## What you do (general flow)
22
23	1. Confirm urgency. Is the key already in a public repo or a deployed
24	site? If yes, this is "do it in the next hour" urgent. If no (e.g.
25	they found it in a private repo and want to clean up), it's "do it
26	today" urgent.
27	2. Walk them through the provider's rotation flow. Use the
28	provider-specific runbook below. Be specific: the exact URL, the
29	exact button label.
30	3. Tell them what to do with the new key. Replace the old key in
31	their `.env`, restart their dev server, redeploy.
32	4. Help them check for damage. Some providers (Stripe, OpenAI)
33	have usage logs they should review for unauthorized activity.
34	5. Confirm the old key is dead. Most providers let you test by
35	trying to use the old key — it should return 401.
36
37	## Provider runbooks
38
39	### Stripe
40
41	1. Open https://dashboard.stripe.com/apikeys
42	2. Find the live secret key (starts with `sk_live_`) — match on the
43	prefix the user gave you
44	3. Click the `···` menu next to it → Roll key
45	4. Stripe asks: "How long should the old key remain active?" Pick **0
46	seconds** (immediate revocation) unless they have automated systems
47	they need to update first
48	5. Stripe shows the new key once — copy it now, you can't see it again
49	6. Where to put the new key:
50	- `.env.local` (or `.env.production` for deployed environment)
51	- Variable name: `STRIPE_SECRET_KEY` (or whatever they used)
52	- Restart their dev server
53	- Redeploy to production (Vercel/Netlify environment variables UI)
54	7. Check for damage:
55	- https://dashboard.stripe.com/payments — look for charges you don't
56	recognize since the leak
57	- https://dashboard.stripe.com/logs — API requests; look for IPs you
58	don't recognize
59	8. Verify rotation worked: try the old key with `curl
60	https://api.stripe.com/v1/charges -u <OLD_KEY>:` — should return 401
61	Unauthorized
62
63	### OpenAI
64
65	1. Open https://platform.openai.com/api-keys
66	2. Find the key that starts with `sk-` matching the prefix
67	3. Click `···` → Revoke key (yes, revoke — not "rotate")
68	4. Click + Create new secret key at the top
69	5. Name it the same as the old one (e.g. "production")
70	6. Copy the new key (only shown once)
71	7. Where to put it:
72	- `.env.local`, variable name `OPENAI_API_KEY`
73	- Restart the dev server
74	- Redeploy
75	8. Check for damage:
76	- https://platform.openai.com/usage — look at the last 7 days for
77	unexpected spikes
78	- https://platform.openai.com/account/limits — confirm spending
79	caps are reasonable; if not, lower them
80	9. Verify rotation: the old key returns 401 immediately on revoke
81
82	### Anthropic
83
84	1. Open https://console.anthropic.com/settings/keys
85	2. Find the key matching prefix (`sk-ant-api03-...`)
86	3. Click · menu → Delete key
87	4. Click + Create Key at the top right
88	5. Copy the new key
89	6. Where to put it:
90	- `.env.local`, variable name `ANTHROPIC_API_KEY`
91	- Restart, redeploy
92	7. Check for damage:
93	- https://console.anthropic.com/settings/usage — last 7 days
94	8. Verify: old key returns 401
95
96	### Google API key (Google Cloud / AI Studio)
97
98	1. For Google AI Studio keys (start with `AIza...`):
99	- Open https://aistudio.google.com/app/apikey
100	- Find the key, click the delete icon
101	- Click Create API key for a new one
102	2. For Google Cloud Platform keys:
103	- Open https://console.cloud.google.com/apis/credentials
104	- Find the API key in the list, click it
105	- Click Delete, then Create credentials → API key
106	- Restrict the new key — under "Application restrictions," limit
107	to specific domains or IPs. Under "API restrictions," limit to
108	only the APIs you actually use.
109	3. Where to put it: `.env.local`, redeploy
110	4. Check for damage: https://console.cloud.google.com/billing —
111	recen

People who liked this also viewed

6 picks

Type