Repository navigation
chore: declare credential env vars in capability manifests (SEC-319) - #205
Open
briangreunke wants to merge 2 commits into
Open
briangreunke wants to merge 2 commits into
briangreunke wants to merge 2 commits into
Conversation
Add a `secrets:` list to each capability that reads credentials or connection settings from the environment, so the catalog and clients list them before install. Every entry sets `required: false`. Several capabilities work without a given name, for example by using OAuth instead of an API key. Bump each changed capability's patch version so sync publishes the new manifest. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
There was a problem hiding this comment.
🟡 Changes recommended
The catalog omits supported credentials and connection settings across several capabilities while advertising an Atlassian API key that the shipped configuration does not use.
4 open issues
What changed in this PR
This manifest-only PR adds credential and connection-variable declarations so capability catalogs and clients can show setup options before installation.
Changes:
- Adds optional
secretsentries to 16 capability manifests. - Bumps each affected capability’s patch version for publication.
- Leaves runtime code unchanged.
| File | Description |
|---|---|
capabilities/web-security/capability.yaml |
Declares web-security integration credentials and endpoints. |
capabilities/sliver-c2/capability.yaml |
Declares the Sliver configuration-file variable. |
capabilities/secure-software/capability.yaml |
Declares Spectra Assure credentials and connection settings. |
capabilities/mythic-c2/capability.yaml |
Declares Mythic authentication and server settings. |
capabilities/mythic-c2-readonly/capability.yaml |
Declares settings for read-only Mythic access. |
capabilities/linear/capability.yaml |
Declares the Linear API key. |
capabilities/gitlab/capability.yaml |
Declares the GitLab token and API URL. |
capabilities/github/capability.yaml |
Declares the GitHub personal access token. |
capabilities/ghostwriter-readonly/capability.yaml |
Declares GhostWriter credentials and endpoint. |
capabilities/bloodhound/capability.yaml |
Declares BloodHound and Neo4j connection settings. |
capabilities/bloodhound-enterprise/capability.yaml |
Declares enterprise authentication options and endpoint. |
capabilities/azure-devops/capability.yaml |
Declares organization, project, and team variables. |
capabilities/attack-surface-management/capability.yaml |
Declares Neo4j and Shodan configuration. |
capabilities/atlassian/capability.yaml |
Declares Atlassian authentication variables. |
capabilities/android-apk-research/capability.yaml |
Declares the AndroZoo API key. |
capabilities/ai-red-teaming/capability.yaml |
Declares the target API key. |
Review effort: Balanced
Comment on lines
+27
to
+28
| - name: TARGET_API_KEY | ||
| required: false |
Contributor
Author
There was a problem hiding this comment.
Added AGENT_API_KEY in 55c9cc2. It is the default for agent_auth_env_var, the same pattern as TARGET_API_KEY.
Not adding the provider variables. The model-routing library reads them for any provider-prefixed model string, not this capability's code, and platform-routed models need none. Listing every provider would bury the settings this capability owns.
| - name: protoscope | ||
| command: 'command -v protoscope >/dev/null 2>&1 || test -x "$HOME/go/bin/protoscope"' | ||
|
|
||
| secrets: |
Contributor
Author
There was a problem hiding this comment.
Added in 55c9cc2: AGENTMAIL_API_KEY, AGENTMAIL_BASE_URL, CAIDO_PROXY, CENSYS_API_KEY, CENSYS_ORGANIZATION_ID, CENSYS_PAT, SECURITYCONTEXT_URL, SHODAN_API_KEY, WEBHOOK_API_KEY, WEBHOOKSITE_API_KEY, and WEBHOOK_SITE_API_KEY.
Add names that code reads through a constant or alias tuple, which the first pass missed: - ai-red-teaming: AGENT_API_KEY, the default agent auth variable - secure-software: SPECTRA_ASSURE_PATH, the portal slug - web-security: AgentMail, webhook.site, Shodan, and Censys keys and aliases, plus AGENTMAIL_BASE_URL, CAIDO_PROXY, and SECURITYCONTEXT_URL Remove ATLASSIAN_API_KEY from atlassian. Only a comment mentions it; the shipped header reads ATLASSIAN_BASIC. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a
secrets:list to 16 capability manifests. Each list names the credential and connection env vars the capability reads, so the catalog and clients show them before install.required: false. Several capabilities work without a given name, for exampleatlassianwith OAuth.CAPABILITY_ROOT,WORKSPACE_ROOT, andDREADNODE_*.Testing
just validate: 26 validated, 0 failed. The 6 warnings come from preflight checks for tools not installed on the test machine. None involve the manifests.pre-commit runon the changed files passes.capability.yamllists the expected names for the 16 changed capabilities,required: falseon each entry, and nosecrets:on the other 10.Refs SEC-319
🤖 Generated with Claude Code