From agentic-security
Rotates a leaked secret end-to-end by detecting the provider, estimating blast radius, and running rotation with optional git history scrubbing.
How this skill is triggered — by the user, by Claude, or both
Slash command
/agentic-security:security-rotate-leakThe summary Claude sees in its skill listing — used to decide when to auto-load this skill
Activates when the user has discovered (or you've discovered) that a
Activates when the user has discovered (or you've discovered) that a production credential is in the repo, the chat, or git history. The clock is running — every hour the value sits exposed is another hour an attacker has to find it.
ai-bodyguard hook) just flagged a hardcoded secret./scan --secrets run produces a critical-severity hit.DO NOT print the leaked value back. Mask it to first-4 + last-4 chars in any output. The chat transcript itself becomes part of the blast radius.
Detect the provider from the prefix:
sk_live_…, rk_live_… → Stripesk-…, sk-proj-… → OpenAIsk-ant-… → Anthropicghp_…, github_pat_… → GitHub PATxoxb-…, xoxa-…, xoxp-… → SlackAKIA… → AWS access key (16 chars after prefix)AIza… → Google API keyrole: service_role claim → Supabase service-roletype: "service_account") → GCPPrint the EXACT revoke URL for that provider's console. Don't
paraphrase — copy from the canonical list. (See commands/rotate-key-auto.md
for the full provider matrix.)
Estimate blast radius BEFORE the rotation, not after:
audit_log table for anomalous reads since the value first appeared.Run the active rotation if the user agrees:
/fix --rotate-secret --auto. This is the only command that touches the
provider's API for you. Without --auto, surface the manual steps
and stop.
Add --scrub-history if the value is in git history. Rewrites
history via git filter-repo or BFG. Note: irreversible, requires
force-push to a shared branch — do NOT run without explicit user
confirmation.
Propose the next step: /fix --vault to migrate the rest of
the project's env-var surface to a real secrets manager so this
doesn't happen again.
--scrub-history without explicit confirmation. It's
irreversible and breaks every clone of the repo..env or push it via the deployment platform's CLI./fix --rotate-secret — guided rotation steps for the detected provider/fix --rotate-secret --auto — end-to-end (revoke + scrub + push replacement)/fix --rotate-secret --auto --scrub-history — also purge from git history/fix --vault — migrate to Doppler / Infisical / platform secretsnpx claudepluginhub clear-capabilities/agentic-security --plugin agentic-securityGuides managing every phase of a secret's lifecycle: generation, distribution, rotation, and revocation. Useful for designing credential retrieval, rotation policies, or responding to exposures.
Detects stolen credential abuse in AWS/GCP/Azure/GitHub audit logs, rotates compromised keys/secrets, verifies rotation after supply chain attacks or incidents.
Manages secrets via leak detection with gitleaks/grep, rotation scheduling, vault setups (AWS/GCP/Azure/HashiCorp Vault), .env safety checks, and access auditing. Activates on leak scans or overdue rotations.