Infisical Skill — AI skill for Claude Code

Infisical Secret Management Skill for AI Agents

The Problem: Secrets in Agent Context Are a Security Risk

When an AI agent holds API keys in its environment variables or system prompt, those secrets are:

• Visible in logs, traces, and conversation history
• Copied into every subagent or spawned worker context
• Exposed if a prompt injection attack extracts the context window
• Rotated manually with no audit trail

The blast radius of a single leaked key expands dramatically when that key lives in a long-running agent session touching dozens of services.

The Solution: Runtime Secret Fetching via Infisical

[Infisical](https://infisical.com) is an open-source secret vault. Instead of baking API keys into agent context, the agent fetches each secret at the moment it is needed, uses the value in the tool call, and discards it. The secret never persists in conversation history or logs.

Agent needs Stripe key
    → calls fetch_secret("STRIPE_SECRET_KEY")
    → Infisical returns the value
    → agent uses value in Stripe API call
    → value is gone — not stored, not logged

Setup

1. Create an Infisical account

Go to [app.infisical.com](https://app.infisical.com) and sign up (free tier available). Or self-host: see [Infisical self-hosting docs](https://infisical.com/docs/self-hosting/overview).

2. Create a project

In the Infisical dashboard, create a new project (e.g., "my-agent"). Note the **Project ID** — you will need it.

3. Add secrets

Inside the project, navigate to the **prod** environment (or create one). Add secrets as key-value pairs, e.g.:

OPENAI_API_KEY    = sk-...
STRIPE_SECRET_KEY = sk_live_...
SENDGRID_API_KEY  = SG....

4. Create a service token

Go to **Project Settings > Service Tokens** and create a token scoped to the environment your agent uses (e.g., `prod`, read-only). Copy the token — it starts with `st.`.

5. Configure your agent

Set two environment variables (these are the only things agen