Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
What This Skill Does
Covers how to store, retrieve, and rotate secrets in CI/CD pipelines using HashiCorp Vault, AWS Secrets Manager, and native platform secret stores. Includes patterns for GitHub Actions, GitLab CI, Kubernetes, and Terraform. Also covers secret scanning to catch leaked credentials before they reach git.
Centralizing secrets in a dedicated store with audit logging and automatic rotation reduces the risk of credential leaks compared to scattering values across .env files, CI variables, and config repositories.
When to use it
- Pulling database passwords into GitHub Actions without hardcoding them
- Rotating API keys automatically on a 90-day schedule
- Syncing Vault secrets into Kubernetes pods via External Secrets Operator
- Blocking secret commits with a pre-commit TruffleHog hook
- Managing environment-specific credentials across dev, staging, and production
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: How do I pull a Vault database secret into my GitHub Actions deploy job?
- 1Enables the KV-v2 secrets engine in Vault and stores the database credentials at a target path
- 2Adds the hashicorp/vault-action step to the GitHub Actions workflow, pointing to the Vault URL and token secret
- 3Maps the Vault secret fields to named environment variables using the secrets mapping syntax
- 4Confirms the secret is masked in logs so it will not appear in job output
A working GitHub Actions workflow YAML that fetches DB credentials from Vault at runtime and exposes them as masked environment variables to subsequent steps
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.