Classify, generate, reference, and persist service credentials as open helper-driven local secret material plus shared-kernel metadata. Use when CTOX must decide whether a credential is generated, discovered, owner-supplied, or an external reference, and when generated admin access must not be forgotten.
Use this skill when the job requires credentials, tokens, passwords, or endpoint references.
Do not use it as the full deployment skill. Pair it with service-deployment or another sibling skill when the broader job is service rollout.
Treat this skill as:
Preferred helper script under scripts/:
secret_material.pyThe helper is inspectable. Read or patch it when the secret shape is unusual.
For every credential-like value, decide one of:
generateddiscoveredowner_suppliedexternal_referenceTrack secret status as well:
presentmissingrotatedinvalidNever default to owner_supplied when CTOX can safely generate a local admin secret itself.
tui_only or email_safe