credential-proxy
Skill0 starsChanged 4 days agoMITView on GitHub
Use when a workload (agent, sandbox, container, CI job) must call an authenticated upstream (LLM/provider/cloud API) but should not hold the credential itself. Keep the secret in a proxy that injects it, so a compromised workload cannot exfiltrate the key.
In this repository108 other files it gives its agents.
- adaptive-estimationSkill
- adaptive-loop-budgetingSkill
- adopt-and-deleteSkill
- adversarial-reviewSkill
- agent-drives-uiSkill
- agentic-coding-loopSkill
- agent-otel-trajectorySkill
- agents-as-iac-modulesSkill
- ascii-ui-mockupsSkill
- authoring-html-emailSkill
- authoring-skills-vs-mcpSkill
- batched-ssh-enumerationSkill
- c4-architectureSkill
- challenge-the-premiseSkill
- codegraph-bootstrapSkill
- codegraph-worktree-startupSkill
- colocated-pod-tolerationsSkill
- command-creatorSkill
- complexity-budgetsSkill
- connector-readinessSkill
- context-anchored-patchingSkill
- continuous-issue-resolutionSkill
- criticality-tiered-reportingSkill
- data-connector-buildingSkill
- declarative-firstSkill
- disk-pressure-forensicsSkill
- early-return-over-elseSkill
- email-triageSkill
- enums-codify-behaviorSkill
- ephemeral-workspace-lifecycleSkill
- event-sourcingSkill
- evidence-claim-boundariesSkill
- exhaustive-matchSkill
- feature-coverage-not-just-line-coverageSkill
- full-disk-forensicsSkill
- gate-before-pushSkill
- github-pr-shepherdingSkill
- graceful-shutdown-stateful-agentsSkill
- grounded-generationSkill
- iac-incident-responseSkill
- iac-not-ad-hocSkill
- instrumented-service-scaffoldSkill
- interface-over-conditionalsSkill
- knowledge-routingSkill
- lean-on-oss-standardsSkill
- live-money-disciplineSkill
- live-state-verificationSkill
- loop-governance-and-learningSkill
- low-level-executor-task-specSkill
- map-dispatch-over-conditionalsSkill
- merge-conflict-disciplineSkill
- mermaid-diagramsSkill
- oke-arc-runners-opentofuSkill
- orchestrate-agySkill
- orchestrate-claudeSkill
- orchestrate-codexSkill
- orchestrate-geminiSkill
- otel-emit-at-willSkill
- parameter-designSkill
- parse-dont-validateSkill
- The first 60 shown.
The file
We split this skill into the rules it gives an agent
4 rules. About 0 are common, 4 are distinctive, and 0 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈4
Distinctive · estimate
This author's own choices. Worth a look.
0
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- Distinctive: line 8
Keep upstream credentials OUT of the workload.
- Distinctive: line 39
Secret source: read the key from a secret store / systemd credentials / a k8s secret mounted ONLY to the proxy — never an env var in the …
- Distinctive: line 41
Inject on ingress, strip on egress: add the upstream auth header.
- Distinctive: line 48
Hygiene: never log the secret; TLS on both hops.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
Credential Proxy
Keep upstream credentials OUT of the workload. Put a small reverse proxy between the workload and the upstream API; the proxy holds the secret and injects it. The workload authenticates to the proxy (cheap, internal) and never sees the upstream key.
When to use
- An agent / sandbox / container / CI job needs an LLM or provider API key.
- The credential is high-value: painful to rotate, billing-attached, or broadly scoped.
- You want one place to rotate, audit, rate-limit, or kill-switch upstream access.
The shape
workload ──▶ proxy (holds the secret) ──▶ upstream API
no key injects Authorization Anthropic / OpenAI / cloud- The workload calls
proxy/<provider>/...with no upstream key. - The proxy injects the
Authorization/ API-key header from a secret store. - The proxy streams the response back and strips anything sensitive.
Why it is worth it
- Blast radius: a compromised workload cannot exfiltrate the key — it never had it.
- Central rotation: rotate in one place; workloads are unaffected.
- Control point: the proxy is the natural choke point for logging, rate limits, quotas, and a kill switch.
Build requirements
- Secret source: read the key from a secret store / systemd credentials / a k8s secret mounted ONLY to the proxy — never an env var in the workload.
- Inject on ingress, strip on egress: add the upstream auth header; drop any client-supplied auth; never reflect the key back.
- Authenticate the workload→proxy hop: per-client token or mTLS. A proxy any workload on the network can use with no auth is just credential laundering — that is the failure mode to avoid.
- Limits: cap request and response body size; enforce per-client rate limits/quotas.
- Streaming: flush SSE/chunked responses promptly; do not buffer the whole stream.
- Hygiene: never log the secret; TLS on both hops.
Verify (real artifact)
- The workload has NO upstream key in its env or mounted secrets (inspect it — absent).
- A real request through the proxy still authenticates upstream and returns a response.
- Rotating/killing the secret at the proxy immediately affects all workloads (one place).
- The proxy rejects an unauthenticated client.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.