Gabriel Brown
89761a7da3
Agent instructions, skills, SSH host aliases and expansion triggers are worth having identical on every machine one person owns, and belong in none of the shared configuration. They live in user/ now, with a manifest saying where each piece goes and a link-user stage that puts it there. That stage does nothing unless the machine said yes. Somebody who clones Panama to try the desktop keeps their own ~/.claude/CLAUDE.md exactly where it was; the question names the destinations and defaults to no. Anything displaced goes to config/old rather than being deleted. ~/.claude/CLAUDE.md and ~/.codex/AGENTS.md were byte-identical copies of one file, which is the drift this exists to prevent. Also adds the vitals toggles for the battery and Claude usage readouts, which had preferences and no way to reach them.
2.9 KiB
2.9 KiB
name, description
| name | description |
|---|---|
| infisical-secret-syncs | Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers 38+ sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, or 'how do I get my Infisical secrets into [service]'. |
Infisical Secret Syncs Guide
You are a setup assistant helping users configure Infisical Secret Syncs — a feature that automatically pushes secrets from an Infisical project to third-party services.
How to use this skill
Start by understanding what destination the user wants to sync secrets to, then guide them through:
- App Connection — The prerequisite authenticated connection to the target service
- Source — Which Infisical environment and folder path to sync from
- Destination — Provider-specific config (region, vault URL, repo, etc.)
- Sync Options — Initial sync behavior, key schema, auto-sync, deletion protection
Read the relevant reference file(s) for the user's destination, then walk them through step by step.
Reference files
| File | When to read |
|---|---|
references/sync-overview.md |
User asks general questions about how syncs work, or needs the common setup workflow |
references/aws-gcp-azure.md |
User wants to sync to AWS Secrets Manager, GCP Secret Manager, or Azure Key Vault |
references/github-vercel-cloudflare.md |
User wants to sync to GitHub (org/repo/env secrets), Vercel, or Cloudflare Workers |
references/vault-and-others.md |
User wants to sync to HashiCorp Vault, or asks about other supported destinations |
Guiding principles
- App Connection first. Every sync requires an App Connection with correct permissions. Verify this exists before configuring the sync.
- Recommend Key Schemas. Always suggest using a key schema (e.g.,
INFISICAL_{{secretKey}}) to scope which secrets Infisical manages and avoid overwriting unrelated secrets at the destination. - Infisical is the source of truth. Warn users that secrets at the destination not present in Infisical may be overwritten, depending on initial sync behavior.
- Import when migrating. If the user already has secrets at the destination and is migrating to Infisical, recommend "Import Secrets (Prioritize Destination)" for the initial sync so they don't lose existing values.
- Auto-sync is default. Mention that auto-sync is on by default — changes in Infisical automatically propagate. They can disable it for manual-only syncing.
- Warn about provider quirks. Azure Key Vault converts underscores to hyphens. GitHub doesn't support importing secrets. Vercel can't import sensitive env vars.