What file permissions does the skill apply?

It strictly enforces 700 permissions for the ./secrets directory and 600 permissions for individual secret files, ensuring they are only accessible by the specific owner and not the root user.

How does it handle containers that don't natively support Docker secrets?

The skill can generate custom docker-entrypoint.sh scripts to safely load secret files into environment variables at runtime for applications that do not support the _FILE suffix.

Can this skill detect secrets already committed to my repository?

Yes, it includes auditing capabilities to scan git history, configuration files, and environment variables for potential leaks or exposed credentials that need to be removed or rotated.

Why should I use this skill instead of just using a .env file?

Plaintext .env files are often accidentally committed to git and lack fine-grained permission controls. This skill migrates credentials to Docker secrets, which are stored in a protected directory and handled securely by the container runtime.

Does it support secret rotation?

Yes, the skill can generate new secure values, update your docker-compose.yml definitions, and verify the new configuration to facilitate seamless credential rotation.

GitLab Stack Secrets Manager | Claude Code Skill

Acerca de

The GitLab Stack Secrets Manager is a specialized skill for Claude Code designed to enforce security best practices for project credentials within containerized environments. It automates the entire lifecycle of Docker secrets—from cryptographically secure generation and permission management to comprehensive auditing for credential leaks in .env or docker-compose.yml files. By centralizing secrets in a protected directory and automating the migration of plaintext variables, this skill helps developers maintain production-grade security standards and prevent accidental exposure in version control systems.

Características Principales

Automated migration of plaintext environment variables to secure Docker secrets
Detailed validation reports identifying critical security vulnerabilities and required actions
Comprehensive security auditing to detect exposed credentials in config files and git history
Strict permission enforcement (700/600) and ownership validation for secret storage
5 GitHub stars
Cryptographically secure secret generation with support for Hex, Base64, and UUID formats

Casos de Uso

Performing security audits on GitLab stack repositories to ensure no API keys or passwords are leaked
Migrating legacy Docker projects from vulnerable .env files to secure Docker secrets architecture
Generating and rotating production-grade credentials for databases, JWTs, and third-party services

Acerca de

Características Principales

Automated migration of plaintext environment variables to secure Docker secrets
Detailed validation reports identifying critical security vulnerabilities and required actions
Comprehensive security auditing to detect exposed credentials in config files and git history
Strict permission enforcement (700/600) and ownership validation for secret storage
5 GitHub stars
Cryptographically secure secret generation with support for Hex, Base64, and UUID formats

Casos de Uso

Performing security audits on GitLab stack repositories to ensure no API keys or passwords are leaked
Migrating legacy Docker projects from vulnerable .env files to secure Docker secrets architecture
Generating and rotating production-grade credentials for databases, JWTs, and third-party services