Vault

Skill G1Joshi/Agent-Skills/skills/security/vault

A comprehensive skill catalog for AI agents

Install

npx -y skills add G1Joshi/Agent-Skills --skill vault

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

10 stars10 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

HashiCorp Vault secrets management. Use for secrets.

SKILL.md

2.1 KB, as published. Nobody here has run it

HashiCorp Vault

Vault is a tool for securely accessing secrets. A secret is anything that you want to tightly control access to, such as API keys, passwords, or certificates. Vault provides a unified interface to any secret while providing tight access control and recording a detailed audit log.

When to Use

Dynamic Secrets: Generating temporary AWS credentials (TTL 15m) for a specific task.
Encryption as a Service: Encrypting application data (Credit Cards) without the app managing the keys (Transit Engine).
Kubernetes Secrets: Injecting secrets into pods securely without Etcd.

Quick Start (Dev Mode)

vault server -dev
export VAULT_ADDR='http://127.0.0.1:8200'

# Write a secret
vault kv put secret/hello foo=world

# Read a secret
vault kv get secret/hello

Core Concepts

Sealing

Vault data is encrypted at rest. When Vault starts, it is "Sealed". Unsealing requires a threshold of keys (Shamir's Secret Sharing) to reconstruct the master key.

Engines

Modules that handle different types of secrets:

kv: Key-Value storage (static).
aws: Dynamic AWS IAM users.
pki: Dynamic x.509 Certificates.

Auth Methods

How you log in to Vault: Token, AppRole (Machines), Kubernetes (Pods), GitHub (Humans).

Best Practices (2025)

Do:

Use Auto-Unseal: Integrate with AWS KMS / Azure Key Vault to unseal automatically (Manual unsealing is painful for uptime).
Inject via Sidecar: In K8s, use the Vault Agent Injector to drop secrets into /vault/secrets/config rather than calling the API directly.
Enable Audit Logs: Essential for knowing "Who read the database password?".

Don't:

Don't use Root Token: Generate it, configure auth methods, then revoke it.
Don't store huge files: Vault is for secrets (KB), not files (MB).