infisical-agent
Skill36 starsChanged 3 months agoMITView on GitHub
Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor `infisical run` (infisical-setup).
- Reads credentials
1 other project uses a version of this.
Adopted by
Most recently taken up by
- Xipher-Labs/walter-ostheir own version, first seen May 21, 2026
Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 1
- Xipher-Labs/walter-os★ 8same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository17 other files it gives its agents.
- AGENTS.mdAGENTS.md
- infisical-access-controlSkill
- infisical-apiSkill
- infisical-app-connectionsSkill
- infisical-dynamic-secretsSkill
- infisical-gatewaySkill
- infisical-kmsSkill
- infisical-kubernetes-operatorSkill
- infisical-pamSkill
- infisical-pkiSkill
- infisical-secret-rotationSkill
- infisical-secret-scanningSkill
- infisical-secret-syncsSkill
- infisical-self-hostSkill
- infisical-setupSkill
- infisical-ssoSkill
- infisical-terraformSkill
The file
We split this skill into the rules it gives an agent
5 rules. About 0 are common, 4 are distinctive, and 1 is very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈4
Distinctive · estimate
This author's own choices. Worth a look.
1
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 24
If it reads a config file, use the agent.
- Distinctive: line 28
Start by understanding the user's deployment context, then guide them through:
- Distinctive: line 35
Read the relevant reference file(s), then walk them through building their config file step by step.
- Distinctive: line 52
Polling interval matters: Default is 5 minutes. For latency-sensitive apps, reduce it.
- Very specific: line 54
On-change commands for reloads: Use execute.command to trigger application restarts or config reloads when secrets change.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Infisical Agent Guide
You are a setup assistant helping users configure the Infisical Agent — a client daemon that simplifies secret management by automatically authenticating, renewing tokens, and rendering secrets to files via Go templates.
Not this skill
The Agent writes secrets to files on a host or in a container. Route elsewhere for:
| If the user wants... | Use |
| Kubernetes Secrets or ConfigMaps managed by a controller | infisical-kubernetes-operator |
infisical run wrapping a process | infisical-setup |
| An SDK call from application code | infisical-setup |
| To configure the machine identity the agent authenticates with | infisical-setup |
| To push secrets to a third-party service | infisical-secret-syncs |
| To configure the dynamic secret the agent leases | infisical-dynamic-secrets |
Operator vs Agent, stated plainly: the operator manages Kubernetes API objects cluster-wide; the agent writes files next to your app. If the app reads env vars from a Secret, use the operator. If it reads a config file, use the agent.
How to use this skill
Start by understanding the user's deployment context, then guide them through:
- Auth method — Which authentication method fits their platform
- Config file — The YAML config structure with auth, sinks, and templates
- Templates — Go template syntax with the correct template functions
- Deployment — Running the agent in their environment (Docker, K8s, ECS, etc.)
Read the relevant reference file(s), then walk them through building their config file step by step.
Reference files
| File | When to read |
references/agent-config.md | User needs the full config file format, field reference, auth methods, sinks, or caching |
references/template-functions.md | User needs to write templates — all available functions with signatures, parameters, and examples |
references/deployment-examples.md | User needs example configs for specific platforms (Docker Compose, ECS, Kubernetes, basic) |
Guiding principles
- Platform-native auth first. On AWS, recommend
aws-iam. On Kubernetes, recommendkubernetes. On Azure, recommendazure. Only fall back touniversal-auth(client ID/secret) when platform-native auth isn't available. - Templates over sinks for secrets. Sinks deposit access tokens. Templates render actual secrets. Most users want templates, not raw access tokens.
- Use
listSecretsorlistSecretsByProjectSlugfor .env files. These are the most common template functions — they render all secrets in an environment to a key=value file. - Use
dynamicSecretfor database credentials. This function creates and auto-renews dynamic secret leases directly in templates. - SSH dynamic secrets need the 6th
principalsargument.dynamicSecrettakes an optional trailing comma-separated principals string, and it is required for SSH dynamic secrets (e.g."root,deploy"). SSH leases returnPRIVATE_KEYandSIGNED_KEY. - Polling interval matters. Default is 5 minutes. For latency-sensitive apps, reduce it. For stable configs, increase it to reduce API calls.
exit-after-auth: truefor init containers. In Kubernetes init containers or one-shot setups, set this so the agent renders secrets once and exits.- On-change commands for reloads. Use
execute.commandto trigger application restarts or config reloads when secrets change. - Never log secret values. The agent writes to files — ensure the destination paths have correct permissions and aren't exposed.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.