secrets-levels

v0.1.0

Places a secret at the right level of the Webgrip estate and names the manifest that puts it there: floor (SOPS), vault (OpenBao), cluster (External Secrets), bridge (Forgejo Actions and Cloudflare Worker secrets), short-lived (OIDC, dynamic credentials, per-run tokens), person (a laptop). The placement half of the secrets model; guard-secrets is the enforcement half.

Claude Code1 Skill

By WebgripLicense: MIT0 GitHub starsUpdated 3 days ago

Directory evidence

Runtimes: Claude Code
Parsed components: 1 skill or MCP entry
Source updated: Oct 4, 2026
Manifest status: Canonical path parsed

The directory validates manifest shape and source location. It does not execute the plugin or provide a security endorsement. Review the indexing methodology →

Install secrets-levels for Claude Code

Installs for the current user

claude plugin marketplace add IchenDEV/agent-plugin-mkt
claude plugin marketplace update agent-plugin-marketplace
claude plugin install secrets-levels@agent-plugin-marketplace

Paste and run these commands in a terminal with Claude Code. They add and refresh the PluginsMP catalog, then install this plugin.

The installer fetches third-party code from the source repository shown on this page. This directory validates manifest structure and source location, but does not perform a security audit; review the manifest, components, and source before installing.

Get the source manually

$ git clone https://github.com/webgrip/ai-skills

Clone the source repository, then follow its setup instructions to add the plugin to a compatible client. The plugin root is skills/secrets-levels/.

Plugin files

skills/secrets-levels/

├── .claude-plugin/plugin.json
└── SKILL.md

Included Skills1

secrets-levelsSKILL.md

Places a secret at the right level of the Webgrip estate and names the manifest that puts it there, per homelab-cluster ADR-0055 - floor (SOPS), vault (OpenBao), cluster (External Secrets), bridge (Forgejo Actions and Cloudflare Worker secrets), short-lived (OIDC, dynamic credentials, per-run tokens), person (a laptop). Use when adding, wiring, rotating, or asking where to put an API key, token, password, credential, PAT, or client secret; when a CI job, workflow, pod, Worker, or developer machine needs a secret; when someone proposes a new sops.yaml, a Forgejo org secret, a Keychain entry, a .env file, or a bao kv put; or when deciding whether a value is entropy, provided, or mintable.

Plugin manifests1

skills/secrets-levels/.claude-plugin/plugin.json

{
  "name": "secrets-levels",
  "displayName": "Secrets Levels",
  "description": "Places a secret at the right level of the Webgrip estate and names the manifest that puts it there: floor (SOPS), vault (OpenBao), cluster (External Secrets), bridge (Forgejo Actions and Cloudflare Worker secrets), short-lived (OIDC, dynamic credentials, per-run tokens), person (a laptop). The placement half of the secrets model; guard-secrets is the enforcement half.",
  "version": "0.1.0",
  "license": "MIT",
  "author": {
    "name": "Webgrip",
    "url": "https://forgejo.webgrip.dev/webgrip"
  },
  "homepage": "https://forgejo.webgrip.dev/webgrip/ai-skills/src/branch/main/skills/secrets-levels",
  "repository": "https://forgejo.webgrip.dev/webgrip/ai-skills",
  "keywords": [
    "secrets",
    "openbao",
    "external-secrets",
    "forgejo-actions",
    "sops",
    "oidc",
    "security"
  ]
}