infisical-access-control
Guide for Infisical access control and governance — org and project roles, custom roles with subject/action permissions, granular secret permissions that separate describing a secret from reading its value, attribute-based access control (ABAC) driven by user metadata and machine identity attributes, additional privileges, assume-privilege, temporary (time-bound) access, access requests, change-approval and access-approval policies, and audit logs including streaming to Splunk, Datadog, Azure, Cribl, Sumo Logic, or a custom webhook. Use this skill when someone asks about: Infisical roles and permissions, custom roles, least privilege for secrets, letting someone see a secret exists without reading it, ABAC, temporary access, approval workflows for secret changes, access requests, audit logs, or streaming audit events to a SIEM. For what a principal can do once inside. Not for connecting an identity provider for login or SCIM (infisical-sso), nor for machine identity auth methods (infis
- Installs
- 165
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/infisical/ai-skills --skill infisical-access-control- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads infisical-access-control automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Infisical Access Control and Governance Guide
You are a setup assistant helping users decide who can do what in Infisical, gate sensitive actions behind approval, and get audit evidence out of the platform.
This skill covers the governance layer that sits across every Infisical product.
Not this skill
| If the user wants... | Use |
|---|---|
| To connect an identity provider for login (SAML/OIDC/LDAP) or auto-provision users | infisical-sso |
| A machine identity and its auth method | infisical-setup |
| Approval before using a privileged infrastructure account, with session recording | infisical-pam |
| Approval before issuing a certificate | infisical-pki |
| Approval before signing an artifact | infisical-pki — Code Signing |
| Roles on PAM folders/accounts specifically | infisical-pam |
| Roles on PKI Applications or Signers specifically | infisical-pki |
Note the split: infisical-sso decides who gets in and who they are; this skill decides what
they can do once inside. If a user asks about SCIM group provisioning, that is SSO — but the roles
those groups map onto are here.
PAM and PKI have their own product-scoped role models (Admin/Connector/Auditor, Admin/Operator/Auditor). Route role questions about those products to their own skills.
How to use this skill
- Start from the least-privilege question: what is the smallest thing this principal needs?
- Reach for a built-in role first — custom roles are maintenance
- Use granular secret actions where "can read the value" is too much
- Add ABAC conditions where access depends on attributes rather than identity
- Prefer temporary over permanent for anything sensitive
- Gate changes with approval policies where a mistake is expensive
- Stream audit logs to wherever the security team already looks
Reference files
| File | When to read |
|---|---|
references/roles-and-permissions.md | Org and project roles, custom roles, permission subjects and actions, the granular secret actions, ABAC, additional privileges, assume-privilege, temporary access |
references/approvals-and-audit.md | Change-approval and access-approval policies, access requests, audit logs, audit log streams and their 6 providers |
Guiding principles
readon secrets is coarser than people expect. The granular actions separatedescribeSecret(see that a secret exists and its metadata) fromreadValue(see the value). The legacyreadgrants both. When someone wants a role that can list secrets without seeing values, they needdescribeSecretwithoutreadValue.- Assign roles to groups, not people. Then joiners and leavers are handled by the identity provider. See
infisical-ssofor group provisioning. - Temporary access over permanent for production and anything sensitive. Access that expires by default is the single highest-leverage control here.
- Approval policies are per environment and path. Scope them to what genuinely needs review; blanket approval on every change produces rubber-stamping, which is worse than none.
no-accessis a real role. Both org and project role sets include it, which is how you keep a member enrolled without granting anything.- Audit logs are only useful if someone sees them. Stream them out; do not leave them to be read in the UI after an incident.
- Never widen permissions to make an error go away. If a user hits a permission error, work out the specific missing subject/action rather than suggesting Admin.
FAQ
What does the infisical-access-control skill do?
Guide for Infisical access control and governance — org and project roles, custom roles with subject/action permissions, granular secret permissions that separate describing a secret from reading its value, attribute-based access control (ABAC) driven by user metadata and machine identity attributes, additional privileges, assume-privilege, temporary (time-bound) access, access requests, change-approval and access-approval policies, and audit logs including streaming to Splunk, Datadog, Azure, Cribl, Sumo Logic, or a custom webhook. Use this skill when someone asks about: Infisical roles and permissions, custom roles, least privilege for secrets, letting someone see a secret exists without reading it, ABAC, temporary access, approval workflows for secret changes, access requests, audit logs, or streaming audit events to a SIEM. For what a principal can do once inside. Not for connecting an identity provider for login or SCIM (infisical-sso), nor for machine identity auth methods (infis
How do I install infisical-access-control?
Run npx skills add https://github.com/infisical/ai-skills --skill infisical-access-control in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/infisical-access-control/ (personal) or .claude/skills/infisical-access-control/ (project).
Which AI agents can use infisical-access-control?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is infisical-access-control safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains infisical-access-control?
It is published by infisical in infisical/ai-skills. It has 165 recorded installs.
More from infisical/ai-skills
infisical-api
infisical/ai-skills
Interact with the Infisical REST API to manage secrets, projects, environments, machine identities, and more. Supports secret CRUD operations, machine identity authentication, pagination, and rate limiting on cloud deployments. Not for the CLI/SDKs (infisical-setup), KMS crypto endpoints (infisical-kms), certificate endpoints (infisical-pki), or human SSO login (infisical-sso).
infisical-secret-syncs
infisical/ai-skills
Guide for configuring Infisical Secret Syncs to push secrets from Infisical to third-party services. Covers all 48 sync destinations including AWS Secrets Manager, GCP Secret Manager, Azure Key Vault, GitHub, Vercel, HashiCorp Vault, Cloudflare, Snowflake, Databricks, Railway, and more. Use this skill when someone asks about: syncing secrets to AWS/GCP/Azure, pushing secrets to GitHub Actions, Vercel environment variables, secret sync setup, App Connections, mapping behavior, key schemas, initial sync behavior, or 'how do I get my Infisical secrets into [service]'. Not for creating the required App Connection (infisical-app-connections), pulling secrets into an app (infisical-setup), syncing certificates (infisical-pki PKI Syncs), or rotating a credential (infisical-secret-rotation).
infisical-user-setup-guide
infisical/ai-skills
Interactive setup guide for using Infisical as a secret management tool in your projects. Helps users integrate Infisical into local development (CLI), Docker containers (build-time and runtime secret injection), CI/CD pipelines (GitHub Actions, GitLab CI), Kubernetes (Operator + CRDs), and application code (all 9 SDKs: Node.js, Python, Go, Java, .NET, Ruby, PHP, Rust, C++). Also walks through choosing and configuring any of the 13 machine identity auth methods (Universal, Token, Kubernetes, GCP, AliCloud, AWS, Azure, TLS Cert, OCI, OIDC, JWT, LDAP, SPIFFE). Use this skill whenever someone asks about: using Infisical, injecting secrets, infisical run, infisical init, connecting their app to Infisical, Docker secrets, Kubernetes secrets operator, machine identity setup, SDK initialization, CI/CD secret injection, or 'how do I get my secrets into my app'. Not for the Kubernetes Operator CRDs (infisical-kubernetes-operator), rendering secrets to files (infisical-agent), pushing secrets ou
infisical-agent
infisical/ai-skills
Guide for configuring the Infisical Agent — a client daemon that manages token lifecycle and renders secrets via Go templates without modifying application code. Covers the full YAML config format, all 6 agent auth methods (universal-auth, kubernetes, aws-iam, azure, gcp-id-token, gcp-iam), sinks, template functions (listSecrets, listSecretsByProjectSlug, getSecretByName, dynamicSecret), polling, on-change commands, retry strategy, and persistent caching. Use this skill when someone asks about: Infisical Agent, agent config file, agent templates, rendering secrets to files, sidecar secret injection, init container secrets, token renewal, infisical agent command, or 'how do I use the Infisical Agent to inject secrets'. Not for Kubernetes Secrets or ConfigMaps managed by a controller (infisical-kubernetes-operator), nor infisical run (infisical-setup).
infisical-dynamic-secrets
infisical/ai-skills
Guide for configuring Infisical Dynamic Secrets — on-demand, short-lived credentials for databases, cloud IAM, SSH, and Kubernetes. Covers all 30 providers including PostgreSQL, MySQL, MSSQL, Oracle, Redis, AWS ElastiCache, AWS MemoryDB, MongoDB, Elasticsearch, Couchbase, Milvus, AWS IAM, GCP IAM, Azure Entra ID, SSH certificates, Kubernetes service accounts, LDAP, GitHub, Tailscale, IBM API Connect, and TOTP. Use this skill when someone asks about: dynamic secrets, ephemeral database credentials, short-lived tokens, rotating database users, dynamic PostgreSQL/MySQL/Redis credentials, SSH certificates, temporary AWS IAM users, lease renewal, or 'how do I generate temporary credentials with Infisical'. For brand-new short-lived credentials created per request. Not for changing an existing credential on a schedule (infisical-secret-rotation), nor for recorded human/agent access without a credential (infisical-pam). Covers SSH certificates; TLS certificates are infisical-pki.
infisical-self-host
infisical/ai-skills
Deploy and operate Infisical self-hosted instances with Docker, Docker Compose, and Kubernetes. Covers architecture, environment variables, ENCRYPTIONKEY management, PostgreSQL setup, Redis configuration (including the required noeviction policy), production hardening, FIPS 140-3 compliance, scaling, and high availability patterns. For deploying the Infisical platform itself. Not for the Kubernetes Operator, which is a separate Helm chart (infisical-kubernetes-operator), nor for using Infisical once running (infisical-setup).
Popular security skills
azure-compliance
microsoft/azure-skills
Run Azure compliance and security audits with azqr plus Key Vault expiration checks. Covers best-practice assessment, resource review, policy/compliance validation, and security posture checks. WHEN: compliance scan, security audit, BEFORE running azqr (compliance cli tool), Azure best practices, Key Vault expiration check, expired certificates, expiring secrets, orphaned resources, compliance assessment.
minimal-run-and-audit
lllllllama/rigorpilot-skills
Rigor Run skill for README-first deep learning repo reproduction. Use when the task is specifically to capture or normalize evidence from the selected smoke test or documented inference or evaluation command and write standardized reprooutputs/ files, including patch notes when repository files changed. Do not use for training execution, initial repo intake, generic environment setup, paper lookup, target selection, hidden scientific-meaning changes, or end-to-end orchestration by itself.
seo-audit
coreyhaines31/marketingskills
When the user wants to audit, review, or diagnose SEO issues on their site. Also use when the user mentions "SEO audit," "technical SEO," "why am I not ranking," "SEO issues," "on-page SEO," "meta tags review," "SEO health check," "my traffic dropped," "lost rankings," "not showing up in Google," "site isn't ranking," "Google update hit me," "page speed," "core web vitals," "crawl errors," "indexing issues," "stuck on page 2," "striking distance keywords," "title tag rewrite," "low CTR," "local SEO," "Google Business Profile," or "map pack." Use this even if the user just says something vague like "my SEO is bad" or "help with SEO" — start with an audit. For building pages at scale to target keywords, see programmatic-seo. For adding structured data, see schema. For AI search optimization, see ai-seo.
firebase-security-rules-auditor
firebase/agent-skills
Audits Firebase (Firestore, Cloud Storage) security rules for vulnerabilities, privilege escalation, role bypasses, create vs update inconsistencies, resource exhaustion, type safety, size limits, and hasOnly ownership checks. Use when auditing/reviewing rules, running red-team rule assessments, or scoring against auditor checklists. Don't use for Firebase CLI (login, deploy), Auth, Crashlytics, Remote Config, or database queries.
audit
pbakaus/impeccable
Run technical quality checks across accessibility, performance, theming, responsive design, and anti-patterns. Generates a scored report with P0-P3 severity ratings and actionable plan. Use when the user wants an accessibility check, performance audit, or technical quality review.
competitors
coreyhaines31/marketingskills
When the user wants to create competitor comparison or alternative pages for SEO and buyer-facing use. Also use when the user mentions 'alternative page,' 'vs page,' 'competitor comparison,' 'comparison page,' '[Product] vs [Product],' '[Product] alternative,' 'competitive landing pages,' 'how do we compare to X,' 'competitor teardown,' 'audit our competitor pages,' 'are our comparison pages out of date,' or 'competitive asset audit.' Use this for any content that positions your product against competitors. Covers four formats: singular alternative, plural alternatives, you vs competitor, and competitor vs competitor. For auditing existing claims (not researching competitors from scratch, which is competitor-profiling; not technical SEO on these pages, which is seo-audit), use the asset audit here. For internal battle cards and sales-specific competitor docs, see sales-enablement.