agentleFS
Sign inStart free
Hack23Hack23/European-Parliament-MCP-Server/.github/skills/secrets-management/SKILL.md

secrets-management

Skill30 starsChanged 9 months agoApache-2.0View on GitHub

Secure credential handling using environment variables, GitHub secrets, and never committing secrets to source code

  • Reads credentials

We split this skill into the rules it gives an agent

2 rules. 0 are common, 2 are distinctive, and 0 are very specific to this project.

  • 0

    Common

    Most of the 32 edited versions we read keep these.

  • 2

    Distinctive

    This author's own choices. Worth a look.

  • 0

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Ensure secure handling of API keys, tokens, and credentials in MCP server development.

    line 11
  2. Distinctive:

    If a secret is committed:

    line 90

“Common” is measured: kept by at least 6 in 10 of the 32 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

Secrets Management Skill

Purpose

Ensure secure handling of API keys, tokens, and credentials in MCP server development. Zero tolerance for hardcoded secrets.

When to Use

  • ✅ Adding external API integrations
  • ✅ Configuring CI/CD pipelines with secrets
  • ✅ Setting up MCP server authentication
  • ✅ Managing GitHub tokens for MCP servers
  • ✅ Reviewing code for credential exposure

Golden Rules

Rule 1: Never Commit Secrets

// ❌ NEVER: Hardcoded credentials
const API_KEY = "sk_live_abc123def456";

// ✅ CORRECT: Environment variables
const API_KEY = process.env['EP_API_KEY'] ?? '';

Rule 2: Use Environment Variables

// MCP server configuration
const config = {
  timeout: Number.parseInt(process.env['EP_REQUEST_TIMEOUT_MS'] ?? '10000'),
  baseUrl: process.env['EP_BASE_URL'] ?? 'https://data.europarl.europa.eu/api/v2',
};

Rule 3: GitHub Secrets for CI/CD

# .github/workflows/ci.yml
env:
  EP_API_KEY: ${{ secrets.EP_API_KEY }}
  NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}

Rule 4: MCP Server Token Security

MCP server tokens are injected at runtime by the GitHub Copilot environment via .github/copilot-mcp.json. Secrets are never stored in configuration files — GitHub resolves ${{ secrets.* }} references during workflow execution:

# .github/copilot-mcp.json uses secret references (resolved by GitHub at runtime)
# The MCP client receives actual token values — never template strings
# See .github/copilot-mcp.json for the canonical configuration

Environment variables for local development:

export GITHUB_TOKEN="ghp_your_token_here"  # Set in shell, never in code

Detection and Prevention

.gitignore Must Include

.env
.env.local
.env.production
*.key
*.pem
secrets/
credentials/

Pre-commit Scanning

# GitHub enables secret scanning automatically
# Additional: npm audit, CodeQL analysis

Incident Response

If a secret is committed:

  1. ✅ Rotate the compromised secret immediately
  2. ✅ Revoke old secret from all systems
  3. ✅ Review access logs for unauthorized access
  4. ✅ Clean git history if possible
  5. ✅ Document incident

ISMS Policy References

Core policies:

Supporting policies:

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free