[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M73FMTRKWHJ2N3B3CDYR86KZ":3,"skill-same:01M73FMTRKWHJ2N3B3CDYR86KZ":51},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":27,"commitSha":28,"skillDirectory":29,"forksCount":30,"repositoryHtmlUrl":31,"repositoryHomepageUrl":32,"ownerHtmlUrl":33,"ownerBlogUrl":34,"ownerDescription":35,"updatedAt":36,"install":37,"resources":50},"01M73FMTRKWHJ2N3B3CDYR86KZ","secrets-vault-patterns",null,"Secure secrets management for agent runtimes. One-time-token gateway, AES-256-GCM at-rest encryption, Shamir's Secret Sharing for API keys, memory zeroization after use, and PBKDF2 key derivation.","Horonomos-laps\u002FYana-AI","Horonomos-laps","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F355299122?v=4","01M76B3QPXE88ET2SQPDPVATZT"," Horonomos-laps","01M72ZQRJPCYPSSWT4D00VJR2A",13,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecrets-vault-patterns\u002FSKILL.md",[],[],"2026-11-11 15:11:14",false,"---\nname: secrets-vault-patterns\ndescription: Secure secrets management for agent runtimes. One-time-token gateway, AES-256-GCM at-rest encryption, Shamir's Secret Sharing for API keys, memory zeroization after use, and PBKDF2 key derivation.\norigin: Google Tink (Apache-2.0), Shamir's Secret Sharing (public domain), OWASP Key Management Cheat Sheet\nlicense: Apache-2.0\nversion: 1.0.0\ncompatibility: claude-sonnet-4-6, claude-opus-4-7\n---\n\n# Secrets Vault Patterns\n\nAgents never see raw secrets. They receive one-time tokens that expire in 5 seconds. Keys are zeroized from memory immediately after use.\n\n## When to Use\n\n- Multi-agent systems where any single agent could be compromised\n- Environments where secrets must not appear in logs, env vars, or CLI args\n- Implementing the YAMTAM secrets-vault-law (rule 52)\n- Rotating API keys without restarting agents\n\n## Do NOT use for\n\n- Developer local setup where secrets are in `.env` (acceptable risk)\n- Systems without Node.js crypto module access\n\n## One-Time-Token Gateway\n\n```js\nimport { randomBytes, createCipheriv, createDecipheriv, createHash } from 'crypto';\n\nclass SecretsVault {\n  constructor(masterKey) {\n    \u002F\u002F masterKey derived via PBKDF2 — never stored raw\n    this.key = createHash('sha256').update(masterKey).digest();\n    this.otts = new Map();  \u002F\u002F token → { secret, expiresAt }\n  }\n\n  \u002F\u002F Issue a one-time-token (5s TTL)\n  issueOTT(secretName) {\n    const secret = this._decrypt(this._store.get(secretName));\n    const token = randomBytes(32).toString('hex');\n    this.otts.set(token, { secret, expiresAt: Date.now() + 5000 });\n    setTimeout(() => this.otts.delete(token), 5000);\n    return token;\n  }\n\n  \u002F\u002F Agent redeems token once\n  redeemOTT(token) {\n    const entry = this.otts.get(token);\n    if (!entry) throw new Error('OTT_INVALID: expired or already used');\n    if (Date.now() > entry.expiresAt) throw new Error('OTT_EXPIRED');\n    this.otts.delete(token);  \u002F\u002F one-time use\n    const secret = entry.secret;\n    \u002F\u002F Zeroize after returning\n    setTimeout(() => { entry.secret = '\\x00'.repeat(entry.secret.length); }, 0);\n    return secret;\n  }\n}\n```\n\n## AES-256-GCM At-Rest Encryption\n\n```js\nfunction encryptSecret(plaintext, key) {\n  const iv = randomBytes(12);  \u002F\u002F 96-bit nonce for GCM\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return Buffer.concat([iv, tag, encrypted]).toString('base64');\n}\n\nfunction decryptSecret(ciphertext, key) {\n  const buf = Buffer.from(ciphertext, 'base64');\n  const iv  = buf.slice(0, 12);\n  const tag = buf.slice(12, 28);\n  const enc = buf.slice(28);\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n  return decipher.update(enc) + decipher.final('utf8');\n}\n```\n\n## PBKDF2 Key Derivation\n\n```js\nimport { pbkdf2Sync, randomBytes } from 'crypto';\n\nfunction deriveKey(masterPassword, salt) {\n  return pbkdf2Sync(\n    masterPassword,\n    salt,\n    310000,         \u002F\u002F OWASP 2023 recommended iterations\n    32,             \u002F\u002F 256-bit output\n    'sha256'\n  );\n}\n\nconst salt = randomBytes(16);\nconst key  = deriveKey(process.env.YAMTAM_MASTER_PASSWORD, salt);\n\u002F\u002F Store salt alongside encrypted data, never store derived key\n```\n\n## Memory Zeroization\n\n```js\nfunction zeroize(buffer) {\n  if (Buffer.isBuffer(buffer)) buffer.fill(0);\n  else if (typeof buffer === 'string') {\n    \u002F\u002F Strings are immutable in JS — minimize exposure window\n    \u002F\u002F Use Buffer for all secret handling\n  }\n}\n\n\u002F\u002F Pattern: derive → use → zeroize immediately\nconst key = deriveKey(password, salt);\ntry {\n  const result = encryptSecret(secret, key);\n  return result;\n} finally {\n  zeroize(key);  \u002F\u002F always runs, even on throw\n}\n```\n\n## Shamir's Secret Sharing (3-of-5)\n\n```js\n\u002F\u002F Split API key into 5 shares, need 3 to reconstruct\n\u002F\u002F Use 'shamir-secret-sharing' npm package (MIT)\nimport { split, combine } from 'shamir-secret-sharing';\n\nconst secret = Buffer.from(process.env.ANTHROPIC_API_KEY);\nconst shares = await split(secret, 5, 3);  \u002F\u002F 5 shares, threshold 3\n\n\u002F\u002F Store shares separately — no single location has the full key\n\u002F\u002F Reconstruct only at call time:\nconst reconstructed = await combine(shares.slice(0, 3));\n```\n\n## Anti-Fake-Pass Checklist\n\n- [ ] OTT expires after 5s — test with `setTimeout(() => vault.redeemOTT(token), 6000)`\n- [ ] OTT is single-use — second `redeemOTT(token)` call throws\n- [ ] AES-GCM auth tag verified (tampered ciphertext throws on `decipher.final()`)\n- [ ] `zeroize()` called in `finally` block — not just in success path\n- [ ] PBKDF2 iterations ≥ 310,000 (OWASP 2023 minimum for SHA-256)\n","# Secrets Vault Patterns\n\nAgents never see raw secrets. They receive one-time tokens that expire in 5 seconds. Keys are zeroized from memory immediately after use.\n\n## When to Use\n\n- Multi-agent systems where any single agent could be compromised\n- Environments where secrets must not appear in logs, env vars, or CLI args\n- Implementing the YAMTAM secrets-vault-law (rule 52)\n- Rotating API keys without restarting agents\n\n## Do NOT use for\n\n- Developer local setup where secrets are in `.env` (acceptable risk)\n- Systems without Node.js crypto module access\n\n## One-Time-Token Gateway\n\n```js\nimport { randomBytes, createCipheriv, createDecipheriv, createHash } from 'crypto';\n\nclass SecretsVault {\n  constructor(masterKey) {\n    \u002F\u002F masterKey derived via PBKDF2 — never stored raw\n    this.key = createHash('sha256').update(masterKey).digest();\n    this.otts = new Map();  \u002F\u002F token → { secret, expiresAt }\n  }\n\n  \u002F\u002F Issue a one-time-token (5s TTL)\n  issueOTT(secretName) {\n    const secret = this._decrypt(this._store.get(secretName));\n    const token = randomBytes(32).toString('hex');\n    this.otts.set(token, { secret, expiresAt: Date.now() + 5000 });\n    setTimeout(() => this.otts.delete(token), 5000);\n    return token;\n  }\n\n  \u002F\u002F Agent redeems token once\n  redeemOTT(token) {\n    const entry = this.otts.get(token);\n    if (!entry) throw new Error('OTT_INVALID: expired or already used');\n    if (Date.now() > entry.expiresAt) throw new Error('OTT_EXPIRED');\n    this.otts.delete(token);  \u002F\u002F one-time use\n    const secret = entry.secret;\n    \u002F\u002F Zeroize after returning\n    setTimeout(() => { entry.secret = '\\x00'.repeat(entry.secret.length); }, 0);\n    return secret;\n  }\n}\n```\n\n## AES-256-GCM At-Rest Encryption\n\n```js\nfunction encryptSecret(plaintext, key) {\n  const iv = randomBytes(12);  \u002F\u002F 96-bit nonce for GCM\n  const cipher = createCipheriv('aes-256-gcm', key, iv);\n  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);\n  const tag = cipher.getAuthTag();\n  return Buffer.concat([iv, tag, encrypted]).toString('base64');\n}\n\nfunction decryptSecret(ciphertext, key) {\n  const buf = Buffer.from(ciphertext, 'base64');\n  const iv  = buf.slice(0, 12);\n  const tag = buf.slice(12, 28);\n  const enc = buf.slice(28);\n  const decipher = createDecipheriv('aes-256-gcm', key, iv);\n  decipher.setAuthTag(tag);\n  return decipher.update(enc) + decipher.final('utf8');\n}\n```\n\n## PBKDF2 Key Derivation\n\n```js\nimport { pbkdf2Sync, randomBytes } from 'crypto';\n\nfunction deriveKey(masterPassword, salt) {\n  return pbkdf2Sync(\n    masterPassword,\n    salt,\n    310000,         \u002F\u002F OWASP 2023 recommended iterations\n    32,             \u002F\u002F 256-bit output\n    'sha256'\n  );\n}\n\nconst salt = randomBytes(16);\nconst key  = deriveKey(process.env.YAMTAM_MASTER_PASSWORD, salt);\n\u002F\u002F Store salt alongside encrypted data, never store derived key\n```\n\n## Memory Zeroization\n\n```js\nfunction zeroize(buffer) {\n  if (Buffer.isBuffer(buffer)) buffer.fill(0);\n  else if (typeof buffer === 'string') {\n    \u002F\u002F Strings are immutable in JS — minimize exposure window\n    \u002F\u002F Use Buffer for all secret handling\n  }\n}\n\n\u002F\u002F Pattern: derive → use → zeroize immediately\nconst key = deriveKey(password, salt);\ntry {\n  const result = encryptSecret(secret, key);\n  return result;\n} finally {\n  zeroize(key);  \u002F\u002F always runs, even on throw\n}\n```\n\n## Shamir's Secret Sharing (3-of-5)\n\n```js\n\u002F\u002F Split API key into 5 shares, need 3 to reconstruct\n\u002F\u002F Use 'shamir-secret-sharing' npm package (MIT)\nimport { split, combine } from 'shamir-secret-sharing';\n\nconst secret = Buffer.from(process.env.ANTHROPIC_API_KEY);\nconst shares = await split(secret, 5, 3);  \u002F\u002F 5 shares, threshold 3\n\n\u002F\u002F Store shares separately — no single location has the full key\n\u002F\u002F Reconstruct only at call time:\nconst reconstructed = await combine(shares.slice(0, 3));\n```\n\n## Anti-Fake-Pass Checklist\n\n- [ ] OTT expires after 5s — test with `setTimeout(() => vault.redeemOTT(token), 6000)`\n- [ ] OTT is single-use — second `redeemOTT(token)` call throws\n- [ ] AES-GCM auth tag verified (tampered ciphertext throws on `decipher.final()`)\n- [ ] `zeroize()` called in `finally` block — not just in success path\n- [ ] PBKDF2 iterations ≥ 310,000 (OWASP 2023 minimum for SHA-256)\n",{"name":5,"origin":24,"license":15,"version":25,"description":7,"compatibility":26},"Google Tink (Apache-2.0), Shamir's Secret Sharing (public domain), OWASP Key Management Cheat Sheet","1.0.0","claude-sonnet-4-6, claude-opus-4-7","main","481dcd7dd2e288b9d627a2bd017db70e64e6c6fa","core\u002Fskills\u002Fsecrets-vault-patterns",2,"https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI","https:\u002F\u002Fyana.vutam.link\u002F","https:\u002F\u002Fgithub.com\u002FHoronomos-laps","https:\u002F\u002Fyana.vutam.link","An open-source governed runtime & execution environment for multi-agent AI systems.","2026-11-12 23:12:27",{"source":8,"skillName":5,"commands":38,"prompt":48,"zipAvailable":49},[39,42,45],{"tool":40,"command":41},"npx","npx skills add Horonomos-laps\u002FYana-AI --skill secrets-vault-patterns",{"tool":43,"command":44},"bunx","bunx skills add Horonomos-laps\u002FYana-AI --skill secrets-vault-patterns",{"tool":46,"command":47},"pnpm","pnpm dlx skills add Horonomos-laps\u002FYana-AI --skill secrets-vault-patterns","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fsecrets-vault-patterns\u002FSKILL.md",true,[],[52,60,67,75,83,91],{"skillNo":53,"name":54,"nameZh":6,"description":55,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":56,"licenseFileUrl":6,"sourceHtmlUrl":57,"categories":58,"keywords":59,"publishedAt":19},"01M735GKET5YVYKAY62W2P5YXB","openai--sentry--sentry","Use when the user asks to inspect Sentry issues or events, summarize recent production errors, or pull basic Sentry health data via the Sentry API; perform read-only queries with the bundled script and require `SENTRY_AUTH_TOKEN`.","MIT","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fopenai--sentry--sentry\u002FSKILL.md",[],[],{"skillNo":61,"name":62,"nameZh":6,"description":63,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":64,"categories":65,"keywords":66,"publishedAt":19},"01M73DCAP83T17HY7SMGK7MGFE","ito-basket-compare","Compare Itô prediction-market baskets against a user's knowledge base, portfolio notes, financial context, watchlist, or research thesis. Use for read-only basket comparison and gap analysis without investment advice or live trading.","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fito-basket-compare\u002FSKILL.md",[],[],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":71,"sourceHtmlUrl":72,"categories":73,"keywords":74,"publishedAt":19},"01M734CYEMZFDR3KH6SW0JP8TD","implementing-network-traffic-baselining","Build network traffic baselines from NetFlow\u002FIPFIX data using Python pandas for statistical analysis, z-score anomaly detection, and hourly\u002Fdaily traffic pattern profiling","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-network-traffic-baselining\u002FSKILL.md",[],[],{"skillNo":76,"name":77,"nameZh":6,"description":78,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":79,"sourceHtmlUrl":80,"categories":81,"keywords":82,"publishedAt":19},"01M73ASZ6NJRJM44Z2P84NGQ3Q","detecting-evasion-techniques-in-endpoint-logs","Detects defense evasion techniques used by adversaries in endpoint logs including log tampering, timestomping, process injection, and security tool disabling. Use when investigating suspicious endpoint behavior, building detection rules for evasion tactics, or conducting threat hunting for stealthy adversary activity. Activates for requests involving evasion detection, defense evasion analysis, log tampering detection, or MITRE ATT&CK TA0005.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002Fcore\u002Fskills\u002Fdetecting-evasion-techniques-in-endpoint-logs\u002FSKILL.md",[],[],{"skillNo":84,"name":85,"nameZh":6,"description":86,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":87,"sourceHtmlUrl":88,"categories":89,"keywords":90,"publishedAt":19},"01M734AFNXD06Z78QRK0VKGT7Q","implementing-microsegmentation-with-guardicore","Implementing microsegmentation using Akamai Guardicore Segmentation to map application dependencies, create granular network policies, visualize east-west traffic flows, and enforce least-privilege communication between workloads across data centers and cloud.","https:\u002F\u002Fgithub.com\u002Fyanacuti1121\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Fimplementing-microsegmentation-with-guardicore\u002FSKILL.md",[],[],{"skillNo":92,"name":93,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":94,"categories":95,"keywords":96,"publishedAt":19},"01M736TK27QMCXK0DVCH25SJN5","ramdisk-tmpfs-patterns","https:\u002F\u002Fgithub.com\u002FHoronomos-laps\u002FYana-AI\u002Fblob\u002Fmain\u002F.claude\u002Fskills\u002Framdisk-tmpfs-patterns\u002FSKILL.md",[],[]]