Kozen secret

Skill kozen-labs/agentic/.agents/skills/kozen-secret

Agentic Repository: Skills, Sub-Agents, Hooks, Context, etc.

Install

npx -y skills add kozen-labs/agentic --skill kozen-secret

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Reference skill for @kozen/secret — a Kozen module that adds unified secret management across AWS Secrets Manager and MongoDB Client-Side Field Level Encryption (CSFLE). Covers the public ISecretManager interface, SecretManager, SecretManagerAWS, and SecretManagerMDB service classes, CLI commands (secret:get, secret:set, secret:metadata), MCP tools (kozen_secret_select, kozen_secret_save), all environment variables, how to use the module as a library dependency, and how to embed it as a programmatic service in other projects.

SKILL.md

3.3 KB, as published. Nobody here has run it

@kozen/secret — Secret Management Module

@kozen/secret extends the Kozen framework with a unified API for retrieving and storing secrets across multiple backends. The same interface works with AWS Secrets Manager and MongoDB Client-Side Field Level Encryption (CSFLE), allowing backend switching via a single --driver flag or environment variable.

Routing table

Signal Reference

SecretModule, ISecretManager, SecretManager, SecretManagerAWS, SecretManagerMDB, ISecretManagerOptions, ISecretArgs, resolve secret, save secret, configure secret, secret:get, secret:set, secret:metadata, secret:help, kozen_secret_select, kozen_secret_save, MCP secret tool, CLI secret command, secret driver, aws driver, mdb driver, createClient AWS, initClient MDB, createDataKey, getKmsProviders, getKeyVaultNamespace, masterKey, SecretManager constructor, standalone secret, library secret, embed secret, secret in delegate, secret in trigger, secret IoC pattern references/api.md

KOZEN_SM_KEY, KOZEN_SM_VAL, KOZEN_SM_DRIVER, KOZEN_SM_ALT, AWS_ACCESS_KEY_ID, MDB_MASTER_KEY, CSFLE key generation, environment variables secret, configure secret module, .env secret, driver comparison, mdb vs aws, security best practices secret references/configuration.md

Signal	Reference
SecretModule, ISecretManager, SecretManager, SecretManagerAWS, SecretManagerMDB, ISecretManagerOptions, ISecretArgs, resolve secret, save secret, configure secret, secret:get, secret:set, secret:metadata, secret:help, kozen_secret_select, kozen_secret_save, MCP secret tool, CLI secret command, secret driver, aws driver, mdb driver, createClient AWS, initClient MDB, createDataKey, getKmsProviders, getKeyVaultNamespace, masterKey, SecretManager constructor, standalone secret, library secret, embed secret, secret in delegate, secret in trigger, secret IoC pattern	`references/api.md`
KOZEN_SM_KEY, KOZEN_SM_VAL, KOZEN_SM_DRIVER, KOZEN_SM_ALT, AWS_ACCESS_KEY_ID, MDB_MASTER_KEY, CSFLE key generation, environment variables secret, configure secret module, .env secret, driver comparison, mdb vs aws, security best practices secret	`references/configuration.md`

When to use this skill

Storing or retrieving credentials, API keys, or other secrets via CLI
Exposing secret operations to an LLM via MCP
Importing SecretManager, SecretManagerAWS, or SecretManagerMDB directly in a project
Understanding the ISecretManager interface to implement a custom backend
Setting up AWS Secrets Manager or MongoDB CSFLE as a secret store

Quick start

npm install @kozen/secret

# Get a secret (MDB CSFLE driver)
npx kozen --moduleLoad=@kozen/secret --action=secret:get --key=MY_API_KEY --driver=mdb

# Get a secret (AWS Secrets Manager driver)
npx kozen --moduleLoad=@kozen/secret --action=secret:get --key=MY_API_KEY --driver=aws

# Save a secret
npx kozen --moduleLoad=@kozen/secret --action=secret:set --key=MY_API_KEY --value=abc123

# Show metadata
npx kozen --moduleLoad=@kozen/secret --action=secret:metadata

Do & Don't

Do:

Always pass the --driver=mdb|aws flag or set KOZEN_SM_DRIVER to select the backend.
When using MongoDB CSFLE, set MDB_MASTER_KEY to a base64-encoded 96-byte key.
Import ISecretManager (not the concrete class) when depending on this module in other code.
Use uriEnv rather than embedding the connection string when using this module programmatically.

Don't:

Never commit MDB_MASTER_KEY or AWS credentials to source control.
Never use MongoDB CSFLE without a valid data encryption key already created in the key vault.