secrets-rotation

Pass

Audited by Gen Agent Trust Hub on Sep 16, 2026

Risk Level: SAFE
Full Analysis
  • [COMMAND_EXECUTION]: The skill includes code snippets demonstrating shell command execution for routine administrative tasks. Specifically, references/kubernetes-secrets-rotation.md contains a CronJob definition that runs python /app/rotate_secrets.py. references/security-checklist.sh is a shell script that generates a markdown checklist using standard redirection (cat > "$OUTPUT"). These are well-documented and intended for legitimate security operations.
  • [REMOTE_CODE_EXECUTION]: The rotateTLSCertificate function in references/nodejs-secrets-manager-with-rotation.md demonstrates using a certbot package to automate TLS certificate requests. This is a standard practice for SSL/TLS management and is restricted to the specific task of certificate renewal.
  • [DATA_EXPOSURE]: The skill references sensitive file paths and resources like VAULT_TOKEN, database-password, and KMS keys. However, it follows safe practices by instructing users to use environment variables (process.env.AWS_REGION) or Kubernetes secretKeyRef rather than hardcoding actual credentials. It explicitly includes a 'DON'T' section advising against hardcoding or sharing secrets.
Audit Metadata
Risk Level
SAFE
Analyzed
Sep 16, 2026, 10:44 AM
Security Audit — agent-trust-hub — secrets-rotation