credential-rotation-protocollisted

This skill should be used whenever a live credential (API key, bot token, access token, etc.) needs to be rotated, changed, OR REMOVED ENTIRELY — whether because it leaked, is being proactively refreshed, is being replaced as part of an incident response, or auth is simply being turned off on a service. Disabling/removing a password is the same category of change as rotating it and needs the same consumer inventory — arguably more so, since there's no new value to hand out, only broken consumers to discover the hard way if you skip the check. Also load it whenever verifying that a credential file/rotation is correct, since that's exactly the step that causes leaks if done wrong. Trigger phrases include "rotate this credential", "the key leaked", "update this token everywhere", "credential rotation", "verify the new key works", "did the secret change", "disable the password", "turn off auth", "remove the login requirement", "no longer needs a password".
jackson2w/claude-code-skills · ★ 1 · AI & Automation · score 64

Install: claude install-skill jackson2w/claude-code-skills

# Safe credential rotation protocol Born from a single 2026-07-19 homelab session that required **four rotations** (three of a Cloudflare R2 key, two of a shared Telegram bot token) because the *verification* step kept leaking the very credential being verified — via three genuinely different mechanisms (`rclone -vv`, `cat file | sed 's/FIELD=.../redacted/'`, `ansible-playbook --check --diff`). Chasing each mechanism reactively (ban `-vv`, then ban `cat`, then ban `--diff`) doesn't scale — the next leak just needs a fourth mechanism nobody thought to ban yet. This skill exists so verification *never requires seeing the secret's actual value*, full stop, regardless of which command someone reaches for. ## A mechanical backstop now exists, but don't rely on it alone As of 2026-09-02, `~/.claude/hooks/block-credential-dump.sh` (wired into `~/.claude/settings.json` as a global `PreToolUse` hook on `Bash`) hard-blocks `cat`/`less`/`head`/`tail`/etc. against a path matching credential-shaped keywords (`.env`, `credential`, `secret`, `password`, `token`, `.ssh/`, `id_rsa`/`id_ed25519`, `.pem`/`.pfx`/`.p12`) — including through an SSH wrapper (`ssh host 'cat ...'`), which is the exact shape of the incident this skill was born from. This is the actual mechanical rule the "prose guidance alone isn't sufficient" note below was asking for. It stays permissive for the safe patterns in the table below (`cut -d=`, `grep -c`, `wc -l`, `ls -la`, checksums, `ansible-vault`). **Don't treat