[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GZ2DHSCESW4PYMSF0JQDEX":3,"skill-same:01M6GZ2DHSCESW4PYMSF0JQDEX":84},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":24,"publishedAt":42,"linkOnly":43,"markdownContent":44,"markdownBody":45,"frontMatter":46,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":6,"ownerHtmlUrl":52,"ownerBlogUrl":53,"ownerDescription":54,"updatedAt":55,"install":56,"resources":69},"01M6GZ2DHSCESW4PYMSF0JQDEX","keep-secrets-out-of-terraform-state",null,"Use when IaC variables or resources may hold credentials. Keeps plaintext secrets out of state and plan files, which sit in a bucket and a CI artefact by default.","jiayaoqijia\u002Fcryptoskill","jiayaoqijia","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F1453879?v=4","01M6GMYTX7Q7S504VC6E756ENR","YQ","01M6GMYV1QKJ1CC75MTTGT9PR0",80,"MIT","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-keep-secrets-out-of-terraform-state\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-keep-secrets-out-of-terraform-state\u002FSKILL.md",[19],{"categoryNo":20,"categoryName":21,"taxonomyType":22,"taxonomyTypeDesc":23},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",[25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41],"state","terraform","keep secrets out of terraform state","secrets","keep","when","bucket","which","Variables","resources","default","files","iac","use","plan","credentials","ci","2026-11-10 10:12:30",false,"---\nname: keep-secrets-out-of-terraform-state\ndescription: Use when IaC variables or resources may hold credentials. Keeps plaintext secrets out of state and plan files, which sit in a bucket and a CI artefact by default.\n---\n\n# Keep secrets out of Terraform state\n\nState records every attribute of every resource, including generated passwords and keys, and it lives in a bucket and a CI artefact. A secret in state is a secret leaked.\n\n## Procedure\n\n1. Treat state as confidential and encrypt it: `encrypt = true` on the S3 backend, SSE-KMS on the bucket, and a bucket policy denying unencrypted PUT.\n2. Never pass secrets as resource arguments that land in state. Reference a secret manager instead:\n       data \"aws_secretsmanager_secret_version\" \"db\" { secret_id = \"prod\u002Fdb\" }\n       password = data.aws_secretsmanager_secret_version.db.secret_string\n   Even this writes the value to state; prefer letting the platform inject it (`manage_master_user_password = true` on RDS).\n3. Mark variables `sensitive = true` so values are redacted in plan output and CI logs.\n4. Scan for leaked secrets before state or plan files leave the runner:\n       grep -rEi 'password|secret|token|private_key' tf.plan.backup || true\n5. Keep plan files out of git: add `*.tfplan`, `*.tfstate`, `*.tfvars` to `.gitignore`, and never commit `terraform.tfstate.backup`.\n6. In CI pull secrets from the runner's OIDC-assumed role or the pipeline secret store at apply time, not from checked-in `terraform.tfvars`.\n7. Rotate anything that was ever written to state: assume it leaked.\n8. Restrict the KMS key at rest with a policy that excludes roles which only need to read.\n\n## Pitfalls\n\n- `variable \"db_password\"` with a default sitting in a committed `terraform.tfvars`.\n- A plan file committed for review that carries a resource's generated password in cleartext.\n- Marking a variable sensitive but then routing it through a `local` used in a non-sensitive output, which un-redacts it.\n- Assuming `sensitive = true` removes the value: it only hides the display, the value stays in state and plan JSON.\n- An output marked `sensitive = true` reused by another output that is not, leaking the value.\n\n## Verification\n\n    aws s3api get-bucket-encryption --bucket acme-tfstate   # SSEConfigured\n    grep -rEi 'password|secret|token|private_key' tf.plan.backup   # no hits\n\nReport: the state encryption config, the secret-manager references used, and the scan result showing no plaintext credentials.\n","# Keep secrets out of Terraform state\n\nState records every attribute of every resource, including generated passwords and keys, and it lives in a bucket and a CI artefact. A secret in state is a secret leaked.\n\n## Procedure\n\n1. Treat state as confidential and encrypt it: `encrypt = true` on the S3 backend, SSE-KMS on the bucket, and a bucket policy denying unencrypted PUT.\n2. Never pass secrets as resource arguments that land in state. Reference a secret manager instead:\n       data \"aws_secretsmanager_secret_version\" \"db\" { secret_id = \"prod\u002Fdb\" }\n       password = data.aws_secretsmanager_secret_version.db.secret_string\n   Even this writes the value to state; prefer letting the platform inject it (`manage_master_user_password = true` on RDS).\n3. Mark variables `sensitive = true` so values are redacted in plan output and CI logs.\n4. Scan for leaked secrets before state or plan files leave the runner:\n       grep -rEi 'password|secret|token|private_key' tf.plan.backup || true\n5. Keep plan files out of git: add `*.tfplan`, `*.tfstate`, `*.tfvars` to `.gitignore`, and never commit `terraform.tfstate.backup`.\n6. In CI pull secrets from the runner's OIDC-assumed role or the pipeline secret store at apply time, not from checked-in `terraform.tfvars`.\n7. Rotate anything that was ever written to state: assume it leaked.\n8. Restrict the KMS key at rest with a policy that excludes roles which only need to read.\n\n## Pitfalls\n\n- `variable \"db_password\"` with a default sitting in a committed `terraform.tfvars`.\n- A plan file committed for review that carries a resource's generated password in cleartext.\n- Marking a variable sensitive but then routing it through a `local` used in a non-sensitive output, which un-redacts it.\n- Assuming `sensitive = true` removes the value: it only hides the display, the value stays in state and plan JSON.\n- An output marked `sensitive = true` reused by another output that is not, leaking the value.\n\n## Verification\n\n    aws s3api get-bucket-encryption --bucket acme-tfstate   # SSEConfigured\n    grep -rEi 'password|secret|token|private_key' tf.plan.backup   # no hits\n\nReport: the state encryption config, the secret-manager references used, and the scan result showing no plaintext credentials.\n",{"name":5,"description":7},"main","3df1d0d67b30ff15236561f8c0f9f06d33f42dfd","skills\u002Fpayments\u002F0xklen-keep-secrets-out-of-terraform-state",17,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia","https:\u002F\u002Feth2030.com","Hardcore infra. Building @alt-research and applied cryptography.","2026-11-11 08:47:40",{"source":8,"skillName":5,"commands":57,"prompt":67,"zipAvailable":68},[58,61,64],{"tool":59,"command":60},"npx","npx skills add jiayaoqijia\u002Fcryptoskill --skill keep-secrets-out-of-terraform-state",{"tool":62,"command":63},"bunx","bunx skills add jiayaoqijia\u002Fcryptoskill --skill keep-secrets-out-of-terraform-state",{"tool":65,"command":66},"pnpm","pnpm dlx skills add jiayaoqijia\u002Fcryptoskill --skill keep-secrets-out-of-terraform-state","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-keep-secrets-out-of-terraform-state\u002FSKILL.md",true,[70,74,80],{"path":71,"resourceType":71,"resourceTypeDesc":72,"sizeBytes":73,"sourceHtmlUrl":16},"LICENSE","许可证",1063,{"path":75,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":78,"sourceHtmlUrl":79},"SOURCE.md","REFERENCE","参考文档",361,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-keep-secrets-out-of-terraform-state\u002FSOURCE.md",{"path":81,"resourceType":76,"resourceTypeDesc":77,"sizeBytes":82,"sourceHtmlUrl":83},"TRUST.auto.yaml",2196,"https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-keep-secrets-out-of-terraform-state\u002FTRUST.auto.yaml",[85,113,136,154,167,177],{"skillNo":86,"name":87,"nameZh":6,"description":88,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":89,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":42},"01M712C436EQYE43342Q4E7GG1","recipe-performance","Diagnose a specific MetaMask user flow's real-app performance and Sentry critical-user-flow telemetry with deterministic mm-harness recipes. Use for CUF boundaries, cold\u002Fwarm\u002Fbackground-resume behavior, latency regressions, lifecycle tags, duplicate or blocking network requests, long tasks, layout\u002Fpaint cost, screen redraws, React rerenders, or browser trace analysis where tests alone cannot prove the real app.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fwallets\u002Fmetamask-official-recipe-performance\u002FSKILL.md",[],[93,94,95,96,97,98,99,100,101,102,103,104,105,106,107,108,109,110,111,112],"performance","recipe performance","recipe","mm","sentry","harness","app","deterministic","recipes","flow","cold","critical","analysis","tasks","react","browser","layout","screen","network","metamask",{"skillNo":114,"name":115,"nameZh":6,"description":116,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":118,"sourceHtmlUrl":119,"categories":120,"keywords":121,"publishedAt":42},"01M70XT2F8A5CQZ81JBP98KSW3","mexc-spot-websocket","MEXC Spot WebSocket workflows for public streams, protobuf handling, depth maintenance, listen keys, and private streams without exposing API keys.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-websocket\u002FSKILL.md",[],[122,123,124,125,126,127,128,129,130,131,132,133,134,135],"mexc spot websocket","spot","websocket","api","workflows","public","listen","streams","depth","keys","for","api keys","maintenance","protobuf",{"skillNo":137,"name":138,"nameZh":6,"description":139,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":140,"sourceHtmlUrl":141,"categories":142,"keywords":143,"publishedAt":42},"01M70XT0MBXN3WZY1BKN0CPNKR","mexc-spot-rest","MEXC Spot REST workflows for public data, signed account requests, orders, wallet\u002Fadmin actions, and secure signing without exposing API keys.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-spot-rest\u002FSKILL.md",[],[144,123,145,146,147,148,149,133,132,131,150,151,152,127,153,126,125],"mexc spot rest","REST","admin","signing","Wallet","requests","actions","secure","data","orders",{"skillNo":155,"name":156,"nameZh":6,"description":157,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":117,"licenseFileUrl":158,"sourceHtmlUrl":159,"categories":160,"keywords":161,"publishedAt":42},"01M70XSYSVZ2N0N91XCAR2CAK0","mexc-futures-websocket","MEXC Futures WebSocket workflows for public streams, private account\u002Forder\u002Fposition streams, ping\u002Fpong, subscriptions, and depth maintenance.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fexchanges\u002Fmncrftfrcnm-mexc-futures-websocket\u002FSKILL.md",[],[162,163,124,164,165,134,132,166,130,129,127,126],"mexc futures websocket","futures","position","ping","subscriptions",{"skillNo":168,"name":169,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":170,"sourceHtmlUrl":171,"categories":172,"keywords":173,"publishedAt":42},"01M6H0ZWHVE5W04WG2DKQE2SQC","0xklen-version-and-refresh-sanctions-lists","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-version-and-refresh-sanctions-lists\u002FSKILL.md",[],[174,175,176],"refresh","0xklen version and refresh sanctions lists","version",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":181,"sourceHtmlUrl":182,"categories":183,"keywords":184,"publishedAt":42},"01M6H0Z28Q3R8J0S799GJQWXM3","verify-tests-cover-changed-lines","Use when a PR adds code that the existing suite may not exercise. Measures patch coverage — the share of newly changed lines hit by tests — before approving.","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FLICENSE","https:\u002F\u002Fgithub.com\u002Fjiayaoqijia\u002Fcryptoskill\u002Fblob\u002Fmain\u002Fskills\u002Fpayments\u002F0xklen-verify-tests-cover-changed-lines\u002FSKILL.md",[],[185,186,187,188,189,190,191,38,192,193,194],"tests","cover","verify tests cover changed lines","verify","coverage","pr","exercise","patch","code","share"]