Rotate Secrets — Development skill for Claude Code
Scan the repo for hardcoded secrets and suggest 1Password/env-based alternatives.
How to install Rotate Secrets
Installs to ~/.claude/skills/kalypsokichu-code-kalypso-claude-workflow-rotate-secrets/SKILL.md
mkdir -p ~/.claude/skills/kalypsokichu-code-kalypso-claude-workflow-rotate-secrets && curl -fsSL https://raw.githubusercontent.com/Kalypsokichu-code/kalypso-claude-workflow/HEAD/commands/rotate-secrets.md -o ~/.claude/skills/kalypsokichu-code-kalypso-claude-workflow-rotate-secrets/SKILL.md Restart Claude Code, or start a new session, for it to be picked up.
What Rotate Secrets does
description: Scan the repo for hardcoded secrets and suggest 1Password/env-based alternatives model: sonnet allowed-tools:
- Read
- Grep
- Glob
- Bash(rg:*)
- Bash(git log:*)
- Bash(git ls-files:*)
Rotate Secrets
Scan the current project for hardcoded secrets and suggest how to rotate them. Do not modify files.
Steps
- Scan using
rg(ripgrep) with these patterns (respect.gitignore):- API key formats:
sk-[a-zA-Z0-9]{20,},AIza[0-9A-Za-z_-]{35}, `ghp_
- API key formats:
Alternatives in Development
- Memory Gc — Inspect or rotate the autopilot ledger JSONL files (findings.jsonl, negatives.jsonl) 3.8k ★
- Agentists Quickstart Deprecated — Opinionated DevPod workspace configs for agentic engineering — Claude Code, shared secrets, VS Code extensions 61 ★
- Rotate Creative — Pause fatigued ads and ship fresh creative variants in their place 48 ★
Full documentation available on GitHub
View Source RepositoryRelated Skills
Firebase Token
Sync (or rotate) the shared Firebase App Check debug token. Source of truth is the team "Convos" 1Password vau
Rotate CLI
Agent-first secrets rotation CLI. Local-first, zero servers. Built after the Vercel April 2026 breach.
Codeword Silly Goose
A Claude skill that catches leaked secrets, refuses to repeat them, and calls you a silly goose until you rota
Review Hardcoded Values
Scan for embedded literals that belong in config or a constants module: URLs, magic numbers, thresholds, error
i18n Wrap
Scan and wrap hardcoded user-facing strings with i18n functions, framework-generic
Secrets Bootstrap
Work with encrypted secrets, env files, and signing material safely.
Related Agents
Secret Purist
The paranoid sentinel of credential security. Use this agent to scan codebases and git history for leaked secr
Tp Audit Scanner
Use this when the user asks for a security / quality audit, pre-release sweep, or "scan this for issues". Find
AI Code Security Auditor
Security reviewer for AI-generated and vibe-coded apps — hunts the hardcoded secrets, broken row-level securit