cred-omega
CISO operacional enterprise para gestao total de credenciais e segredos.
Profile →npx skills add sickn33/agentic-awesome-skills --skill cred-omega --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
What it does
Maps to a Security Engine for All API Keys (Enterprise) that discovers, classifies, protects, and governs credentials and secrets across providers, with emphasis on rotation, least privilege, and governance for various credential types.
How it works
The skill guides the agent to: discover where secrets may reside (code, env files, git history, CI/CD, containers, logs, backups), remove exposure by ensuring no secrets exist in repos/logs/history, reduce blast radius via least privilege and environment scoping, modernize authentication using short-lived tokens and secret managers, and implement governance including inventory, rotation, auditing, anomaly detection, incident response, and continuous compliance. It provides concrete scanning commands and patterns to locate secrets (regex and file searches), checks historical git commits for secrets, and defines a multi-phase process (Reconhecimento, Descoberta, Classificacao, Contencao, Hardening, Governanca) with detailed steps for proxy architecture, secret registries, rotinas de governanca, and pre-commit/CI safeguards. It also prescribes environment separation, access controls, rotation schedules, and observability without exposing secrets in logs.
When to use it
Use when you need specialized assistance with cred omega domain and governance of credentials across providers.
What it can touch
Declared tools include: claude-code, antigravity, cursor, gemini-cli, codex-cli. The skill prescribes using a proxy-based architecture on a VPS, a Secret Store/Secret Registry, and a central governance registry, with steps for middleware, rate limiting, quotas, and audit logging. It references commands and files like:
- Generic shell commands for scanning: rg, find, git, docker, etc.
- Proxy server structure under /opt/api-gateway with server.js and middleware/auth.js, rateLimit.js, quota.js.
- JSON secret registry schema shown in the governance section.
Caveats
Contains operational security guidance and hardening practices, including rotation policies, environment separation, and proxy-based secret injection. It emphasizes that secrets must reside in Secret Manager/Vault/env secure runtime injection and not in client-side code. It notes risk as critical and prescribes immediate containment steps for P0/P1 scenarios, with no promise of outcomes beyond stated procedures.
# CRED-OMEGA: Security Engine for All API Keys (Enterprise) ## Overview CISO operacional enterprise para gestao total de credenciais e segredos. Descobre, classifica, protege e governa TODAS as API keys, tokens, secrets, service accounts e credenciais em qualquer provedor (OpenAI, Google Cloud, Meta/WhatsApp/Facebook/Instagram, Telegram, AWS, Azure, Stripe, Twilio, e qualquer API futura). Auditoria de codigo, git history, containers, CI/CD, VPS, logs e backups. ## When to Use This Skill - When you need specialized assistance with this domain ## Do Not Use This Skill When - The task is unrelated to cred omega - A simpler, more specific tool can handle the request - The user needs general-purpose assistance without domain expertise ## How It Works > Voce e o **SAFE-CHECK** — Agente Supremo de Seguranca de Credenciais. > Sua missao: prevenir vazamentos, reduzir permissoes ao minimo, impor rotacao > e expirar segredos, criar governanca continua para TODO tipo de credencial > em TODOS os provedores, com execucao pratica em VPS e repositorios locais. --- ### 1.1 As 5 Missoes Inegociaveis 1. **DESCOBRIR** — Encontrar onde estao (ou poderiam estar) segredos: codigo, .env, commits antigos,
- Overview
- When to Use This Skill
- Do Not Use This Skill When
- How It Works
- 1.1 As 5 Missoes Inegociaveis
- 1.2 Regras De Ouro (Nunca Violar)
- 1.3 Mentalidade De Seguranca
- 2.1 Tipos De Credenciais (Taxonomia Completa)
- 2.2 Onde Vazam (Superficie De Ataque)
- Fase 0 — Reconhecimento (Mapear Ambiente)
- Fase 1 — Descoberta (Varredura Profunda)
- Fase 2 — Classificacao De Risco
- Fase 3 — Contencao (Acao Imediata)
- Fase 4 — Hardening (Protecao Profunda)
rg -n --hidden --no-ignore -S \
find . -maxdepth 8 -type f \( \
rg -n "sk-[a-zA-Z0-9]{20,}" . --glob '!node_modules' --glob '!.git'
rg -n "AIza[a-zA-Z0-9_-]{35}" . --glob '!node_modules' --glob '!.git'
rg -n "AKIA[A-Z0-9]{16}" . --glob '!node_modules' --glob '!.git'
rg -n "sk_live_[a-zA-Z0-9]{20,}" . --glob '!node_modules' --glob '!.git'
rg -n "EAA[a-zA-Z0-9]{50,}" . --glob '!node_modules' --glob '!.git'
rg -n "[0-9]{8,10}:[a-zA-Z0-9_-]{35}" . --glob '!node_modules' --glob '!.git'
rg -n "ghp_[a-zA-Z0-9]{36}" . --glob '!node_modules' --glob '!.git'
rg -n "eyJ[a-zA-Z0-9_-]{10,}\\.eyJ[a-zA-Z0-9_-]{10,}" . --glob '!node_modules' --glob '!.git'What does the cred-omega skill do?
CISO operacional enterprise para gestao total de credenciais e segredos.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill cred-omega --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.