[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6CD00DGJQXQNT8DG9GDCTHJ":3,"skill-same:01M6CD00DGJQXQNT8DG9GDCTHJ":108},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":51,"linkOnly":52,"markdownContent":53,"markdownBody":54,"frontMatter":55,"refName":57,"commitSha":58,"skillDirectory":59,"forksCount":60,"repositoryHtmlUrl":61,"repositoryHomepageUrl":6,"ownerHtmlUrl":62,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":63,"install":64,"resources":77},"01M6CD00DGJQXQNT8DG9GDCTHJ","doppler-secrets",null,"Use the Doppler CLI to access and manage secrets safely in both ad hoc scripts and long-lived projects. Covers CLI install, env injection, project binding via doppler.yaml, environments, service tokens, Docker, Kubernetes, and CI\u002FCD integration. Use when a task touches secrets and must avoid exposing them in logs, prompts, command history, or tool output.","cercova-studios\u002F10x-swe","cercova-studios","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F217108198?v=4","01M6CCYGHXTH80N3BXRW6KESTE","Cercova Studios","01M6CCYGPADH5MJDR0VNNR775C",1,"MIT","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fdoppler-secrets\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50],"doppler","secrets","doppler secrets","command","when","output","long","env","tokens","project","task","manage","prompts","use","install","cli","history","tool","projects","access","injection","ci","logs","yaml","integration","kubernetes","docker","2026-11-10 10:12:30",false,"---\nname: doppler-secrets\ndescription: Use the Doppler CLI to access and manage secrets safely in both ad hoc scripts and long-lived projects. Covers CLI install, env injection, project binding via doppler.yaml, environments, service tokens, Docker, Kubernetes, and CI\u002FCD integration. Use when a task touches secrets and must avoid exposing them in logs, prompts, command history, or tool output.\ncompatibility: Requires the Doppler CLI and a Doppler account (DOPPLER_TOKEN or doppler login).\n---\n\n\u003Cobjective>\nProvide a single, authoritative workflow for using the Doppler CLI to handle secrets safely across ad hoc scripting and long-lived projects.\n\u003C\u002Fobjective>\n\n\u003Cessential_rules>\n1) Doppler CLI only.\n- Never use the Doppler MCP for secret access.\n- Use the `doppler` CLI for all reads, writes, validation, and runtime injection.\n\n2) Never expose secret values.\n- Never print secrets to stdout\u002Fstderr.\n- Never include secret values in LLM\u002Ftool message bodies, prompts, or files.\n- Never serialize secrets into files, stack traces, debug dumps, or shell history.\n- When commands carry tokens, set `export HISTIGNORE='doppler*:export DOPPLER_TOKEN*'` first.\n\n3) Prefer env injection over value retrieval.\n- Primary pattern: `doppler run --project=\u003Cp> --config=\u003Cc> -- \u003Ccommand>`.\n- Application reads injected env vars internally.\n- Avoid `doppler secrets get` \u002F `doppler secrets download` unless strictly required, and never log the output.\n\n4) Bind repos with a committed `doppler.yaml`.\n- Project-root `doppler.yaml` lets `doppler setup --no-interactive` work for teammates and CI.\n- Per-user state lives in `~\u002F.doppler\u002F.doppler.yaml` and must NOT be hand-edited.\n\u003C\u002Fessential_rules>\n\n\u003Cstep_0_install_hedge>\nAlways check the CLI is installed before any other step. If missing, install via the OS-appropriate method below, then re-check.\n\nDetection:\n```bash\nif ! command -v doppler >\u002Fdev\u002Fnull 2>&1; then\n  echo \"doppler CLI missing — installing\" >&2\n  # run an install branch from the table below\nfi\ndoppler --version\n```\n\nOS-specific install (use the first matching branch):\n\n- macOS (Homebrew):\n  ```bash\n  brew install dopplerhq\u002Fcli\u002Fdoppler\n  ```\n\n- Linux — Debian\u002FUbuntu (apt, signed repo, persistent):\n  ```bash\n  sudo apt-get update\n  sudo apt-get install -y apt-transport-https ca-certificates curl gnupg\n  curl -sLf --retry 3 --tlsv1.2 --proto \"=https\" \\\n    'https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fgpg.DE2A7741A397C129.key' \\\n    | sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Fdoppler-archive-keyring.gpg\n  echo \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Fdoppler-archive-keyring.gpg] https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fdeb\u002Fdebian any-version main\" \\\n    | sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fdoppler-cli.list\n  sudo apt-get update && sudo apt-get install -y doppler\n  ```\n\n- Linux — RHEL\u002FCentOS\u002FFedora (yum\u002Fdnf):\n  ```bash\n  sudo rpm --import 'https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fgpg.DE2A7741A397C129.key'\n  curl -sLf --retry 3 --tlsv1.2 --proto \"=https\" \\\n    'https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fconfig.rpm.txt' \\\n    | sudo tee \u002Fetc\u002Fyum.repos.d\u002Fdoppler-cli.repo\n  sudo dnf install -y doppler || sudo yum install -y doppler\n  ```\n\n- Linux\u002FmacOS fallback or CI — official install script:\n  ```bash\n  (curl -Ls --tlsv1.2 --proto \"=https\" --retry 3 https:\u002F\u002Fcli.doppler.com\u002Finstall.sh \\\n    || wget -t 3 -qO- https:\u002F\u002Fcli.doppler.com\u002Finstall.sh) | sh\n  ```\n\n- Windows (PowerShell, winget):\n  ```powershell\n  winget install doppler\n  ```\n\n- Docker \u002F containers (no package manager): bake into the image — see `templates\u002FDockerfile.doppler.snippet`.\n\nAuthoritative sources (consult only if you suspect a stale flag):\n- https:\u002F\u002Fdocs.doppler.com\u002Fdocs\u002Finstall-cli\n- https:\u002F\u002Fgithub.com\u002FDopplerHQ\u002Fcli\n\nAfter install, verify:\n```bash\ndoppler --version\n```\nDo NOT proceed if the CLI is still missing — report the install failure and stop.\n\u003C\u002Fstep_0_install_hedge>\n\n\u003Cquick_start>\n1. Ensure CLI installed (see step 0).\n2. `doppler login` (once per machine; opens browser).\n3. In repo root: `doppler setup` to pick project + config (or commit a `doppler.yaml`).\n4. Run code via `doppler run -- \u003Ccommand>`.\n5. For non-interactive environments (CI, prod, containers): use a service token via `DOPPLER_TOKEN`.\n\u003C\u002Fquick_start>\n\n────────────────────────────────────────────────────────\nPART A — AD HOC SCRIPTS\n────────────────────────────────────────────────────────\n\n\u003Cad_hoc_workflow>\n\n\u003Cstep_1_preflight>\nVerify CLI + auth:\n```bash\ncommand -v doppler >\u002Fdev\u002Fnull || { echo \"doppler CLI missing\" >&2; exit 1; }\ndoppler configure debug >\u002Fdev\u002Fnull 2>&1 || { echo \"doppler not authed\u002Fconfigured\" >&2; exit 1; }\n```\n\u003C\u002Fstep_1_preflight>\n\n\u003Cstep_2_validate_required_names>\nValidate secret names only — never values:\n```bash\ndoppler secrets --project=\u003Cproject> --config=\u003Cconfig> --only-names --json\n```\nCompare required names against this list. Do not retrieve values during validation.\n\u003C\u002Fstep_2_validate_required_names>\n\n\u003Cstep_3_execute_with_env_injection>\nPreferred:\n```bash\ndoppler run --project=\u003Cproject> --config=\u003Cconfig> -- python \u002Fpath\u002Fto\u002Fscript.py\n```\nMulti-command:\n```bash\ndoppler run --project=\u003Cp> --config=\u003Cc> --command=\".\u002Fconfigure && .\u002Frun; .\u002Fcleanup\"\n```\n\u003C\u002Fstep_3_execute_with_env_injection>\n\n\u003Cstep_4_safe_python_pattern>\nSee `templates\u002Fsecure_python_with_doppler_cli_env.py`. Read env, never print secrets:\n```python\nimport os, sys\nrequired = [\"X_OAUTH2_ACCESS_TOKEN\"]\nmissing = [k for k in required if not os.getenv(k)]\nif missing:\n    print(f\"Missing required secret env vars: {', '.join(missing)}\", file=sys.stderr)\n    raise SystemExit(1)\ntoken = os.environ[\"X_OAUTH2_ACCESS_TOKEN\"]  # use directly; never log\n```\n\u003C\u002Fstep_4_safe_python_pattern>\n\n\u003Cstep_5_output_sanitization>\nAllowed: counts, ids, timestamps, non-sensitive identifiers, summarized findings.\nForbidden: token strings, secret values, env dumps, full credentialed request dumps.\n\u003C\u002Fstep_5_output_sanitization>\n\n\u003C\u002Fad_hoc_workflow>\n\n────────────────────────────────────────────────────────\nPART B — PROJECTS \u002F LONG-LIVED APPLICATIONS\n────────────────────────────────────────────────────────\n\n\u003Cproject_workflow>\n\n\u003Cstep_1_bind_repo_to_project>\nRun once per repo, in repo root:\n```bash\ndoppler setup\n```\nThis writes scope into `~\u002F.doppler\u002F.doppler.yaml` (per-user, never hand-edit).\n\nFor team-wide reproducibility, also commit a `doppler.yaml` at the repo root (see `templates\u002Fdoppler.yaml`):\n```yaml\nsetup:\n  - project: my-app\n    config: dev\n```\nMonorepo variant:\n```yaml\nsetup:\n  - path: backend\u002F\n    project: my-app-api\n    config: dev\n  - path: frontend\u002F\n    project: my-app-web\n    config: dev\n```\nTeammates and CI then run:\n```bash\ndoppler setup --no-interactive\n```\n\u003C\u002Fstep_1_bind_repo_to_project>\n\n\u003Cstep_2_environments_and_configs>\nDoppler hierarchy: `Workspace → Project → Environment (dev\u002Fstg\u002Fprd) → Config`.\n- Branch configs (e.g. `dev_personal`) inherit from a root config (`dev`) and override per-developer.\n- Promote secrets between environments via the dashboard (review\u002Fapproval) rather than copy-paste.\n- For new projects, bootstrap structure declaratively with `doppler-template.yaml` + `doppler import`. See https:\u002F\u002Fdocs.doppler.com\u002Fdocs\u002Fproject-templates.\n\u003C\u002Fstep_2_environments_and_configs>\n\n\u003Cstep_3_application_runtime>\nAlways launch the app under `doppler run`:\n```bash\ndoppler run -- npm start\ndoppler run -- python -m myapp\ndoppler run -- .\u002Fbin\u002Fserver\n```\nDo not call `doppler secrets download` to materialize a `.env` for the app at runtime if `doppler run` is viable.\n\u003C\u002Fstep_3_application_runtime>\n\n\u003Cstep_4_service_tokens_for_non_interactive>\nService tokens are read-only, scoped to a single project+config. Use them everywhere a human is not present (CI, prod, containers, VMs).\n\nCreate:\n```bash\n# interactive setup, then mint\ndoppler setup\ndoppler configs tokens create ci-deploy --plain\n\n# or single-shot\ndoppler configs tokens create ci-deploy \\\n  --project my-app --config prd --plain\n```\nEphemeral token (auto-expires):\n```bash\nDOPPLER_TOKEN=$(doppler configs tokens create job-$(date +%s) \\\n  --project my-app --config prd --max-age 5m --plain)\n```\nRevoke:\n```bash\ndoppler configs tokens revoke -p my-app -c prd dp.st.prd.xxxx\n```\n\nAuth precedence (highest → lowest): `--token` flag → `DOPPLER_TOKEN` env → `--project\u002F--config` flags → directory scope in `~\u002F.doppler\u002F.doppler.yaml`.\n\u003C\u002Fstep_4_service_tokens_for_non_interactive>\n\n\u003Cstep_5_ci_cd>\nGitHub Actions example (token from repo secrets):\n```yaml\n- uses: dopplerhq\u002Fcli-action@v3\n- env:\n    DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN_PRD }}\n  run: doppler run -- .\u002Fdeploy.sh\n```\nRules:\n- Store the service token in the CI provider's secret store; never echo it.\n- Use one token per environment (prd\u002Fstg\u002Fdev).\n- Set `HISTIGNORE='export DOPPLER_TOKEN*'` in any shell that may be recorded.\n\u003C\u002Fstep_5_ci_cd>\n\n\u003Cstep_6_docker>\nPattern A — bake CLI into image, inject token at runtime (recommended):\n```dockerfile\n# see templates\u002FDockerfile.doppler.snippet for the full snippet\nRUN (curl -Ls --tlsv1.2 --proto \"=https\" --retry 3 https:\u002F\u002Fcli.doppler.com\u002Finstall.sh) | sh\nENTRYPOINT [\"doppler\", \"run\", \"--\"]\nCMD [\"node\", \"server.js\"]\n```\nRun:\n```bash\ndocker run -e DOPPLER_TOKEN=\"$DOPPLER_TOKEN\" my-app:latest\n```\n\nPattern B — host-side injection (no Doppler in image):\n```bash\ndoppler run -- docker compose up\n```\n\nNever `COPY .env` into an image. Never bake `DOPPLER_TOKEN` into a layer.\n\u003C\u002Fstep_6_docker>\n\n\u003Cstep_7_kubernetes>\nTwo supported approaches:\n\n1) Doppler Kubernetes Operator (recommended) — syncs Doppler configs into native `Secret` objects; pods consume via `envFrom`. Install via Helm; see https:\u002F\u002Fdocs.doppler.com\u002Fdocs\u002Fkubernetes-operator. The Operator handles rotation; no `doppler` binary in the image.\n\n2) `doppler run` inside containers using `DOPPLER_TOKEN` from a K8s Secret:\n```bash\nkubectl create secret generic doppler-token \\\n  --from-literal=DOPPLER_TOKEN='dp.st.prd.xxxx'\n```\n```yaml\nspec:\n  containers:\n    - name: app\n      image: my-app:latest\n      envFrom:\n        - secretRef:\n            name: doppler-token\n```\n\nPrefer (1) for production. Use (2) when the Operator is not available.\n\u003C\u002Fstep_7_kubernetes>\n\n\u003Cstep_8_local_env_hygiene>\n- Do NOT commit `.env`, `.env.local`, `.env.*` (except `.env.example` containing names only).\n- DO commit `doppler.yaml` (project binding) and `doppler-template.yaml` (project bootstrap).\n- Add to `.gitignore`:\n  ```\n  .env\n  .env.*\n  !.env.example\n  ```\n- If a `.env` must be generated for a tool that cannot use `doppler run` (e.g. some IDEs):\n  ```bash\n  doppler secrets download --no-file --format env > .env\n  ```\n  Treat the file as ephemeral, ensure `.gitignore` covers it, and delete it after use.\n- Pre-commit hooks: enable a secret scanner (gitleaks, trufflehog) to catch accidental commits.\n\u003C\u002Fstep_8_local_env_hygiene>\n\n\u003Cstep_9_rotation_and_history>\n- View change history: `doppler secrets history SECRET_NAME` (or dashboard).\n- Rotate via dashboard or integration (AWS\u002FGCP\u002FAzure rotation connectors).\n- After rotation, restart consumers (apps re-read env at process start, not in-place).\n- For automated rotation triggers, configure Doppler webhooks to ping your deploy\u002Frestart endpoint.\n\u003C\u002Fstep_9_rotation_and_history>\n\n\u003C\u002Fproject_workflow>\n\n────────────────────────────────────────────────────────\nCOMMON FAILURES & FIXES\n────────────────────────────────────────────────────────\n\n\u003Ccommon_failures_and_fixes>\n- `doppler: command not found` → run install hedge for the OS (step 0) and re-verify with `doppler --version`.\n- Auth\u002Fconfig not initialized → `doppler login` (interactive) or set `DOPPLER_TOKEN` (non-interactive).\n- \"This token does not have access to requested config\" → token scope mismatch; mint a new token for the correct project+config.\n- Wrong secrets returned → check resolution with `doppler configure debug` and `doppler configure --scope $(pwd)`; confirm `doppler.yaml` matches the desired config.\n- Secrets logged accidentally → strip debug prints, redact exceptions, never dump env or auth headers.\n- Missing secrets at runtime → verify names exist in selected project\u002Fconfig (`doppler secrets --only-names`) and confirm the runtime is actually under `doppler run` or has `DOPPLER_TOKEN` set.\n- Token leaked in shell history → rotate the token immediately (`doppler configs tokens revoke`), mint a new one, and set `HISTIGNORE` going forward.\n\u003C\u002Fcommon_failures_and_fixes>\n\n────────────────────────────────────────────────────────\nVERIFICATION CHECKLIST\n────────────────────────────────────────────────────────\n\n\u003Cverification_checklist>\n- [ ] `doppler --version` succeeds (CLI installed)\n- [ ] Auth confirmed (`doppler configure debug` shows token source) OR `DOPPLER_TOKEN` set\n- [ ] For projects: `doppler.yaml` committed; `.env*` ignored; `.env.example` (names only) optional\n- [ ] Secret names validated without reading values\n- [ ] Application launched via `doppler run` (or Operator-injected env)\n- [ ] No secret output in logs\u002Fmessages\u002Ffiles\u002Fshell history\n- [ ] Service tokens scoped per environment; no human tokens in CI\u002Fprod\n- [ ] Final response sanitized\n\u003C\u002Fverification_checklist>\n\n\u003Csuccess_criteria>\nAgents reliably install, configure, and operate Doppler — for one-off scripts and long-lived projects — using CLI env injection and scoped service tokens, while preserving strict non-disclosure of secret values across all outputs.\n\u003C\u002Fsuccess_criteria>\n","\u003Cobjective>\nProvide a single, authoritative workflow for using the Doppler CLI to handle secrets safely across ad hoc scripting and long-lived projects.\n\u003C\u002Fobjective>\n\n\u003Cessential_rules>\n1) Doppler CLI only.\n- Never use the Doppler MCP for secret access.\n- Use the `doppler` CLI for all reads, writes, validation, and runtime injection.\n\n2) Never expose secret values.\n- Never print secrets to stdout\u002Fstderr.\n- Never include secret values in LLM\u002Ftool message bodies, prompts, or files.\n- Never serialize secrets into files, stack traces, debug dumps, or shell history.\n- When commands carry tokens, set `export HISTIGNORE='doppler*:export DOPPLER_TOKEN*'` first.\n\n3) Prefer env injection over value retrieval.\n- Primary pattern: `doppler run --project=\u003Cp> --config=\u003Cc> -- \u003Ccommand>`.\n- Application reads injected env vars internally.\n- Avoid `doppler secrets get` \u002F `doppler secrets download` unless strictly required, and never log the output.\n\n4) Bind repos with a committed `doppler.yaml`.\n- Project-root `doppler.yaml` lets `doppler setup --no-interactive` work for teammates and CI.\n- Per-user state lives in `~\u002F.doppler\u002F.doppler.yaml` and must NOT be hand-edited.\n\u003C\u002Fessential_rules>\n\n\u003Cstep_0_install_hedge>\nAlways check the CLI is installed before any other step. If missing, install via the OS-appropriate method below, then re-check.\n\nDetection:\n```bash\nif ! command -v doppler >\u002Fdev\u002Fnull 2>&1; then\n  echo \"doppler CLI missing — installing\" >&2\n  # run an install branch from the table below\nfi\ndoppler --version\n```\n\nOS-specific install (use the first matching branch):\n\n- macOS (Homebrew):\n  ```bash\n  brew install dopplerhq\u002Fcli\u002Fdoppler\n  ```\n\n- Linux — Debian\u002FUbuntu (apt, signed repo, persistent):\n  ```bash\n  sudo apt-get update\n  sudo apt-get install -y apt-transport-https ca-certificates curl gnupg\n  curl -sLf --retry 3 --tlsv1.2 --proto \"=https\" \\\n    'https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fgpg.DE2A7741A397C129.key' \\\n    | sudo gpg --dearmor -o \u002Fusr\u002Fshare\u002Fkeyrings\u002Fdoppler-archive-keyring.gpg\n  echo \"deb [signed-by=\u002Fusr\u002Fshare\u002Fkeyrings\u002Fdoppler-archive-keyring.gpg] https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fdeb\u002Fdebian any-version main\" \\\n    | sudo tee \u002Fetc\u002Fapt\u002Fsources.list.d\u002Fdoppler-cli.list\n  sudo apt-get update && sudo apt-get install -y doppler\n  ```\n\n- Linux — RHEL\u002FCentOS\u002FFedora (yum\u002Fdnf):\n  ```bash\n  sudo rpm --import 'https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fgpg.DE2A7741A397C129.key'\n  curl -sLf --retry 3 --tlsv1.2 --proto \"=https\" \\\n    'https:\u002F\u002Fpackages.doppler.com\u002Fpublic\u002Fcli\u002Fconfig.rpm.txt' \\\n    | sudo tee \u002Fetc\u002Fyum.repos.d\u002Fdoppler-cli.repo\n  sudo dnf install -y doppler || sudo yum install -y doppler\n  ```\n\n- Linux\u002FmacOS fallback or CI — official install script:\n  ```bash\n  (curl -Ls --tlsv1.2 --proto \"=https\" --retry 3 https:\u002F\u002Fcli.doppler.com\u002Finstall.sh \\\n    || wget -t 3 -qO- https:\u002F\u002Fcli.doppler.com\u002Finstall.sh) | sh\n  ```\n\n- Windows (PowerShell, winget):\n  ```powershell\n  winget install doppler\n  ```\n\n- Docker \u002F containers (no package manager): bake into the image — see `templates\u002FDockerfile.doppler.snippet`.\n\nAuthoritative sources (consult only if you suspect a stale flag):\n- https:\u002F\u002Fdocs.doppler.com\u002Fdocs\u002Finstall-cli\n- https:\u002F\u002Fgithub.com\u002FDopplerHQ\u002Fcli\n\nAfter install, verify:\n```bash\ndoppler --version\n```\nDo NOT proceed if the CLI is still missing — report the install failure and stop.\n\u003C\u002Fstep_0_install_hedge>\n\n\u003Cquick_start>\n1. Ensure CLI installed (see step 0).\n2. `doppler login` (once per machine; opens browser).\n3. In repo root: `doppler setup` to pick project + config (or commit a `doppler.yaml`).\n4. Run code via `doppler run -- \u003Ccommand>`.\n5. For non-interactive environments (CI, prod, containers): use a service token via `DOPPLER_TOKEN`.\n\u003C\u002Fquick_start>\n\n────────────────────────────────────────────────────────\nPART A — AD HOC SCRIPTS\n────────────────────────────────────────────────────────\n\n\u003Cad_hoc_workflow>\n\n\u003Cstep_1_preflight>\nVerify CLI + auth:\n```bash\ncommand -v doppler >\u002Fdev\u002Fnull || { echo \"doppler CLI missing\" >&2; exit 1; }\ndoppler configure debug >\u002Fdev\u002Fnull 2>&1 || { echo \"doppler not authed\u002Fconfigured\" >&2; exit 1; }\n```\n\u003C\u002Fstep_1_preflight>\n\n\u003Cstep_2_validate_required_names>\nValidate secret names only — never values:\n```bash\ndoppler secrets --project=\u003Cproject> --config=\u003Cconfig> --only-names --json\n```\nCompare required names against this list. Do not retrieve values during validation.\n\u003C\u002Fstep_2_validate_required_names>\n\n\u003Cstep_3_execute_with_env_injection>\nPreferred:\n```bash\ndoppler run --project=\u003Cproject> --config=\u003Cconfig> -- python \u002Fpath\u002Fto\u002Fscript.py\n```\nMulti-command:\n```bash\ndoppler run --project=\u003Cp> --config=\u003Cc> --command=\".\u002Fconfigure && .\u002Frun; .\u002Fcleanup\"\n```\n\u003C\u002Fstep_3_execute_with_env_injection>\n\n\u003Cstep_4_safe_python_pattern>\nSee `templates\u002Fsecure_python_with_doppler_cli_env.py`. Read env, never print secrets:\n```python\nimport os, sys\nrequired = [\"X_OAUTH2_ACCESS_TOKEN\"]\nmissing = [k for k in required if not os.getenv(k)]\nif missing:\n    print(f\"Missing required secret env vars: {', '.join(missing)}\", file=sys.stderr)\n    raise SystemExit(1)\ntoken = os.environ[\"X_OAUTH2_ACCESS_TOKEN\"]  # use directly; never log\n```\n\u003C\u002Fstep_4_safe_python_pattern>\n\n\u003Cstep_5_output_sanitization>\nAllowed: counts, ids, timestamps, non-sensitive identifiers, summarized findings.\nForbidden: token strings, secret values, env dumps, full credentialed request dumps.\n\u003C\u002Fstep_5_output_sanitization>\n\n\u003C\u002Fad_hoc_workflow>\n\n────────────────────────────────────────────────────────\nPART B — PROJECTS \u002F LONG-LIVED APPLICATIONS\n────────────────────────────────────────────────────────\n\n\u003Cproject_workflow>\n\n\u003Cstep_1_bind_repo_to_project>\nRun once per repo, in repo root:\n```bash\ndoppler setup\n```\nThis writes scope into `~\u002F.doppler\u002F.doppler.yaml` (per-user, never hand-edit).\n\nFor team-wide reproducibility, also commit a `doppler.yaml` at the repo root (see `templates\u002Fdoppler.yaml`):\n```yaml\nsetup:\n  - project: my-app\n    config: dev\n```\nMonorepo variant:\n```yaml\nsetup:\n  - path: backend\u002F\n    project: my-app-api\n    config: dev\n  - path: frontend\u002F\n    project: my-app-web\n    config: dev\n```\nTeammates and CI then run:\n```bash\ndoppler setup --no-interactive\n```\n\u003C\u002Fstep_1_bind_repo_to_project>\n\n\u003Cstep_2_environments_and_configs>\nDoppler hierarchy: `Workspace → Project → Environment (dev\u002Fstg\u002Fprd) → Config`.\n- Branch configs (e.g. `dev_personal`) inherit from a root config (`dev`) and override per-developer.\n- Promote secrets between environments via the dashboard (review\u002Fapproval) rather than copy-paste.\n- For new projects, bootstrap structure declaratively with `doppler-template.yaml` + `doppler import`. See https:\u002F\u002Fdocs.doppler.com\u002Fdocs\u002Fproject-templates.\n\u003C\u002Fstep_2_environments_and_configs>\n\n\u003Cstep_3_application_runtime>\nAlways launch the app under `doppler run`:\n```bash\ndoppler run -- npm start\ndoppler run -- python -m myapp\ndoppler run -- .\u002Fbin\u002Fserver\n```\nDo not call `doppler secrets download` to materialize a `.env` for the app at runtime if `doppler run` is viable.\n\u003C\u002Fstep_3_application_runtime>\n\n\u003Cstep_4_service_tokens_for_non_interactive>\nService tokens are read-only, scoped to a single project+config. Use them everywhere a human is not present (CI, prod, containers, VMs).\n\nCreate:\n```bash\n# interactive setup, then mint\ndoppler setup\ndoppler configs tokens create ci-deploy --plain\n\n# or single-shot\ndoppler configs tokens create ci-deploy \\\n  --project my-app --config prd --plain\n```\nEphemeral token (auto-expires):\n```bash\nDOPPLER_TOKEN=$(doppler configs tokens create job-$(date +%s) \\\n  --project my-app --config prd --max-age 5m --plain)\n```\nRevoke:\n```bash\ndoppler configs tokens revoke -p my-app -c prd dp.st.prd.xxxx\n```\n\nAuth precedence (highest → lowest): `--token` flag → `DOPPLER_TOKEN` env → `--project\u002F--config` flags → directory scope in `~\u002F.doppler\u002F.doppler.yaml`.\n\u003C\u002Fstep_4_service_tokens_for_non_interactive>\n\n\u003Cstep_5_ci_cd>\nGitHub Actions example (token from repo secrets):\n```yaml\n- uses: dopplerhq\u002Fcli-action@v3\n- env:\n    DOPPLER_TOKEN: ${{ secrets.DOPPLER_TOKEN_PRD }}\n  run: doppler run -- .\u002Fdeploy.sh\n```\nRules:\n- Store the service token in the CI provider's secret store; never echo it.\n- Use one token per environment (prd\u002Fstg\u002Fdev).\n- Set `HISTIGNORE='export DOPPLER_TOKEN*'` in any shell that may be recorded.\n\u003C\u002Fstep_5_ci_cd>\n\n\u003Cstep_6_docker>\nPattern A — bake CLI into image, inject token at runtime (recommended):\n```dockerfile\n# see templates\u002FDockerfile.doppler.snippet for the full snippet\nRUN (curl -Ls --tlsv1.2 --proto \"=https\" --retry 3 https:\u002F\u002Fcli.doppler.com\u002Finstall.sh) | sh\nENTRYPOINT [\"doppler\", \"run\", \"--\"]\nCMD [\"node\", \"server.js\"]\n```\nRun:\n```bash\ndocker run -e DOPPLER_TOKEN=\"$DOPPLER_TOKEN\" my-app:latest\n```\n\nPattern B — host-side injection (no Doppler in image):\n```bash\ndoppler run -- docker compose up\n```\n\nNever `COPY .env` into an image. Never bake `DOPPLER_TOKEN` into a layer.\n\u003C\u002Fstep_6_docker>\n\n\u003Cstep_7_kubernetes>\nTwo supported approaches:\n\n1) Doppler Kubernetes Operator (recommended) — syncs Doppler configs into native `Secret` objects; pods consume via `envFrom`. Install via Helm; see https:\u002F\u002Fdocs.doppler.com\u002Fdocs\u002Fkubernetes-operator. The Operator handles rotation; no `doppler` binary in the image.\n\n2) `doppler run` inside containers using `DOPPLER_TOKEN` from a K8s Secret:\n```bash\nkubectl create secret generic doppler-token \\\n  --from-literal=DOPPLER_TOKEN='dp.st.prd.xxxx'\n```\n```yaml\nspec:\n  containers:\n    - name: app\n      image: my-app:latest\n      envFrom:\n        - secretRef:\n            name: doppler-token\n```\n\nPrefer (1) for production. Use (2) when the Operator is not available.\n\u003C\u002Fstep_7_kubernetes>\n\n\u003Cstep_8_local_env_hygiene>\n- Do NOT commit `.env`, `.env.local`, `.env.*` (except `.env.example` containing names only).\n- DO commit `doppler.yaml` (project binding) and `doppler-template.yaml` (project bootstrap).\n- Add to `.gitignore`:\n  ```\n  .env\n  .env.*\n  !.env.example\n  ```\n- If a `.env` must be generated for a tool that cannot use `doppler run` (e.g. some IDEs):\n  ```bash\n  doppler secrets download --no-file --format env > .env\n  ```\n  Treat the file as ephemeral, ensure `.gitignore` covers it, and delete it after use.\n- Pre-commit hooks: enable a secret scanner (gitleaks, trufflehog) to catch accidental commits.\n\u003C\u002Fstep_8_local_env_hygiene>\n\n\u003Cstep_9_rotation_and_history>\n- View change history: `doppler secrets history SECRET_NAME` (or dashboard).\n- Rotate via dashboard or integration (AWS\u002FGCP\u002FAzure rotation connectors).\n- After rotation, restart consumers (apps re-read env at process start, not in-place).\n- For automated rotation triggers, configure Doppler webhooks to ping your deploy\u002Frestart endpoint.\n\u003C\u002Fstep_9_rotation_and_history>\n\n\u003C\u002Fproject_workflow>\n\n────────────────────────────────────────────────────────\nCOMMON FAILURES & FIXES\n────────────────────────────────────────────────────────\n\n\u003Ccommon_failures_and_fixes>\n- `doppler: command not found` → run install hedge for the OS (step 0) and re-verify with `doppler --version`.\n- Auth\u002Fconfig not initialized → `doppler login` (interactive) or set `DOPPLER_TOKEN` (non-interactive).\n- \"This token does not have access to requested config\" → token scope mismatch; mint a new token for the correct project+config.\n- Wrong secrets returned → check resolution with `doppler configure debug` and `doppler configure --scope $(pwd)`; confirm `doppler.yaml` matches the desired config.\n- Secrets logged accidentally → strip debug prints, redact exceptions, never dump env or auth headers.\n- Missing secrets at runtime → verify names exist in selected project\u002Fconfig (`doppler secrets --only-names`) and confirm the runtime is actually under `doppler run` or has `DOPPLER_TOKEN` set.\n- Token leaked in shell history → rotate the token immediately (`doppler configs tokens revoke`), mint a new one, and set `HISTIGNORE` going forward.\n\u003C\u002Fcommon_failures_and_fixes>\n\n────────────────────────────────────────────────────────\nVERIFICATION CHECKLIST\n────────────────────────────────────────────────────────\n\n\u003Cverification_checklist>\n- [ ] `doppler --version` succeeds (CLI installed)\n- [ ] Auth confirmed (`doppler configure debug` shows token source) OR `DOPPLER_TOKEN` set\n- [ ] For projects: `doppler.yaml` committed; `.env*` ignored; `.env.example` (names only) optional\n- [ ] Secret names validated without reading values\n- [ ] Application launched via `doppler run` (or Operator-injected env)\n- [ ] No secret output in logs\u002Fmessages\u002Ffiles\u002Fshell history\n- [ ] Service tokens scoped per environment; no human tokens in CI\u002Fprod\n- [ ] Final response sanitized\n\u003C\u002Fverification_checklist>\n\n\u003Csuccess_criteria>\nAgents reliably install, configure, and operate Doppler — for one-off scripts and long-lived projects — using CLI env injection and scoped service tokens, while preserving strict non-disclosure of secret values across all outputs.\n\u003C\u002Fsuccess_criteria>\n",{"name":5,"description":7,"compatibility":56},"Requires the Doppler CLI and a Doppler account (DOPPLER_TOKEN or doppler login).","main","12441d84a8a292fcc94f47bc98877cbefd9b52e2","plugins\u002F10x-swe\u002Fskills\u002Fdoppler-secrets",0,"https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe","https:\u002F\u002Fgithub.com\u002Fcercova-studios","2026-11-12 07:39:44",{"source":8,"skillName":5,"commands":65,"prompt":75,"zipAvailable":76},[66,69,72],{"tool":67,"command":68},"npx","npx skills add cercova-studios\u002F10x-swe --skill doppler-secrets",{"tool":70,"command":71},"bunx","bunx skills add cercova-studios\u002F10x-swe --skill doppler-secrets",{"tool":73,"command":74},"pnpm","pnpm dlx skills add cercova-studios\u002F10x-swe --skill doppler-secrets","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fdoppler-secrets\u002FSKILL.md",true,[78,84,90,94,100,104],{"path":79,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":82,"sourceHtmlUrl":83},"resources\u002Fcore-module.yaml","REFERENCE","参考文档",723,"https:\u002F\u002Fgithub.com\u002FManju-Bharati-Mahto\u002FNerve\u002Fblob\u002Fmain\u002F_bmad\u002Fcore\u002Fbmad-init\u002Fresources\u002Fcore-module.yaml",{"path":85,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":88,"sourceHtmlUrl":89},"scripts\u002Fbmad_init.py","SCRIPT","脚本",21227,"https:\u002F\u002Fgithub.com\u002FManju-Bharati-Mahto\u002FNerve\u002Fblob\u002Fmain\u002F_bmad\u002Fcore\u002Fbmad-init\u002Fscripts\u002Fbmad_init.py",{"path":91,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":92,"sourceHtmlUrl":93},"scripts\u002Ftests\u002Ftest_bmad_init.py",11226,"https:\u002F\u002Fgithub.com\u002FManju-Bharati-Mahto\u002FNerve\u002Fblob\u002Fmain\u002F_bmad\u002Fcore\u002Fbmad-init\u002Fscripts\u002Ftests\u002Ftest_bmad_init.py",{"path":95,"resourceType":96,"resourceTypeDesc":97,"sizeBytes":98,"sourceHtmlUrl":99},"templates\u002FDockerfile.doppler.snippet","OTHER","其他",1146,"https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fdoppler-secrets\u002Ftemplates\u002FDockerfile.doppler.snippet",{"path":101,"resourceType":80,"resourceTypeDesc":81,"sizeBytes":102,"sourceHtmlUrl":103},"templates\u002Fdoppler.yaml",620,"https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fdoppler-secrets\u002Ftemplates\u002Fdoppler.yaml",{"path":105,"resourceType":86,"resourceTypeDesc":87,"sizeBytes":106,"sourceHtmlUrl":107},"templates\u002Fsecure_python_with_doppler_cli_env.py",724,"https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fdoppler-secrets\u002Ftemplates\u002Fsecure_python_with_doppler_cli_env.py",[109,145,182,202,221,233],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":114,"sourceHtmlUrl":115,"categories":116,"keywords":120,"publishedAt":51},"01M6CD3T6EQ9N5KPNXCM6ABHVA","turnstile-spin","Set up Cloudflare Turnstile end-to-end in a project. Scan the codebase, create the widget via the Cloudflare API, embed it where user requests need bot verification (form submissions, SPA actions, API endpoints, download links, comment or vote submissions, etc.), wire canonical server-side siteverify in the customer's existing backend, validate, and persist the skill. Load this when a user asks to add Turnstile, set up CAPTCHA, protect a form or endpoint from bots, or fix a Turnstile integration. Uses Cloudflare's documented Turnstile contract.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fturnstile-spin\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Fturnstile-spin\u002FSKILL.md",[117],{"categoryNo":118,"categoryName":119,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",[121,122,123,124,125,126,127,128,129,130,131,132,133,134,135,136,137,138,139,48,140,141,142,33,143,144,28],"turnstile spin","SET","nextjs","actions","up","fix","cloudflare","bot","api","permissions","create","astro","server","verification","plugin","endpoints","customer","backend","sveltekit","app","bots","spa","end","SWE",{"skillNo":146,"name":147,"nameZh":6,"description":148,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":113,"licenseFileUrl":149,"sourceHtmlUrl":150,"categories":151,"keywords":163,"publishedAt":51},"01M6CD0BJYRNV610HYYPX933RE","frontend-design","Create distinctive, production-grade frontend interfaces with high design quality. Use this skill when the user asks to build web components, pages, or applications. Generates creative, polished code that avoids generic AI aesthetics.","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Ffrontend-design\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002F10x-swe\u002Fskills\u002Ffrontend-design\u002FSKILL.md",[152,155,158],{"categoryNo":153,"categoryName":154,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",{"categoryNo":156,"categoryName":157,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000015","视觉设计",{"categoryNo":159,"categoryName":160,"taxonomyType":161,"taxonomyTypeDesc":162},"01JBSEEDCAT000000000000032","设计师","PROFESSION","适用职业",[164,165,166,131,167,168,169,170,171,172,37,173,174,175,176,177,178,28,179,180,181],"frontend design","frontend","design","web","quality","applications","creative","web components","Production","code","components","user","generic","aesthetics","pages","with","high","build",{"skillNo":183,"name":184,"nameZh":6,"description":185,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":186,"categories":187,"keywords":188,"publishedAt":51},"01M6CD4QX8C4DST98AY21HEYCM","source-insights","Prepare inspected source evidence, preserve exact citations, and publish reviewed insights into an explicit local library.","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002Fknowledge\u002Fskills\u002Fsource-insights\u002FSKILL.md",[],[189,190,191,192,193,194,195,196,197,198,199,200,201],"source insights","insights","source","publish","Citations","evidence","library","workflows","prepare","session","global","local","preserve",{"skillNo":203,"name":204,"nameZh":6,"description":205,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":206,"categories":207,"keywords":211,"publishedAt":51},"01M6CD4N1HVNC1EXPEBZT7YS31","skill-graph","Discover skills and workflows through independent lexical search, relationship paths and a terminal graph.","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002Fknowledge\u002Fskills\u002Fskill-graph\u002FSKILL.md",[208],{"categoryNo":209,"categoryName":210,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[212,213,135,196,214,215,216,199,217,218,219,144,220],"graph","skill graph","terminal","10x","search","discover skills","discover","paths","relationship",{"skillNo":222,"name":223,"nameZh":6,"description":224,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":225,"categories":226,"keywords":227,"publishedAt":51},"01M6CD4HQKXNZ57YEGD8QVK6Z6","session-search","Recall public session turns with exact provenance, bounded excerpts and independent piped exports.","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002Fknowledge\u002Fskills\u002Fsession-search\u002FSKILL.md",[],[216,198,228,229,196,230,231,199,179,190,191,232],"session search","public","provenance","recall","bounded",{"skillNo":234,"name":235,"nameZh":6,"description":236,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":237,"categories":238,"keywords":245,"publishedAt":51},"01M6CD4ET7DVNBYPDAMAYMSK2T","newsletter","Produce a private local AI newsletter from bounded public research, with cited deep dives, HTML\u002FMarkdown output, Dagu scheduling and seven-day retention.","https:\u002F\u002Fgithub.com\u002Fcercova-studios\u002F10x-swe\u002Fblob\u002Fmain\u002Fplugins\u002Fknowledge\u002Fskills\u002Fnewsletter\u002FSKILL.md",[239,242],{"categoryNo":240,"categoryName":241,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000005","邮件与沟通",{"categoryNo":243,"categoryName":244,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000021","资料检索与研究",[235,246,247,248,249,229,196,250,251,252,253,199,179,254,255,200,232,29],"local ai","dagu","produce","research","markdown","scheduling","html","daily","deep","retention"]