diff --git a/capabilities/ai-red-teaming/capability.yaml b/capabilities/ai-red-teaming/capability.yaml
index 4501768a..2e37c821 100644
--- a/capabilities/ai-red-teaming/capability.yaml
+++ b/capabilities/ai-red-teaming/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: ai-red-teaming
-version: "1.20.3"
+version: "1.20.4"
 description: >
   Probe the security and safety of AI applications, agents, and foundation models.
   Orchestrates adversarial attack workflows to discover vulnerabilities in LLMs,
@@ -23,6 +23,12 @@ tools:
 hooks:
   - hooks/block_cli_provisioning.py
 
+secrets:
+  - name: AGENT_API_KEY
+    required: false
+  - name: TARGET_API_KEY
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/android-apk-research/capability.yaml b/capabilities/android-apk-research/capability.yaml
index abf49eda..1666a7e1 100644
--- a/capabilities/android-apk-research/capability.yaml
+++ b/capabilities/android-apk-research/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: android-apk-research
-version: "0.2.0"
+version: "0.2.1"
 description: >
   Static semantic-bug research on Android APKs — deep-link routers, intent
   redirection, WebView trust boundaries, auth/session/client-state bypass,
@@ -37,6 +37,10 @@ checks:
   - name: apkid
     command: 'command -v apkid >/dev/null 2>&1'
 
+secrets:
+  - name: ANDROZOO_API_KEY
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/atlassian/capability.yaml b/capabilities/atlassian/capability.yaml
index d26add9d..654e502d 100644
--- a/capabilities/atlassian/capability.yaml
+++ b/capabilities/atlassian/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: atlassian
-version: "1.0.0"
+version: "1.0.1"
 description: >
   Connect to Atlassian Cloud (Jira, Confluence, Compass) from chat and
   agents — search and read issues, pages, and components; create or
@@ -45,6 +45,10 @@ mcp:
 skills:
   - skills/atlassian/
 
+secrets:
+  - name: ATLASSIAN_BASIC
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/attack-surface-management/capability.yaml b/capabilities/attack-surface-management/capability.yaml
index 4c31487c..73052193 100644
--- a/capabilities/attack-surface-management/capability.yaml
+++ b/capabilities/attack-surface-management/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: attack-surface-management
-version: "2.0.4"
+version: "2.0.5"
 description: >
   External attack surface management with BBOT reconnaissance scanning,
   Neo4j graph database analysis, Shodan internet intelligence, and
@@ -76,6 +76,18 @@ checks:
   - name: fastmcp-python
     command: "python3 -c 'import fastmcp'"
 
+secrets:
+  - name: NEO4J_PASSWORD
+    required: false
+  - name: NEO4J_URI
+    required: false
+  - name: NEO4J_USER
+    required: false
+  - name: SHODAN_API_KEY
+    required: false
+  - name: SHODAN_API_URL
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/azure-devops/capability.yaml b/capabilities/azure-devops/capability.yaml
index 702c2522..d5d4ebee 100644
--- a/capabilities/azure-devops/capability.yaml
+++ b/capabilities/azure-devops/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: azure-devops
-version: "1.0.0"
+version: "1.0.1"
 description: >
   Connect to Azure DevOps (Boards, Repos, Pipelines, Wiki) from chat and
   agents — query work items with WIQL, read PRs, inspect pipeline runs,
@@ -63,6 +63,14 @@ checks:
 skills:
   - skills/azure-devops/
 
+secrets:
+  - name: ADO_ORG
+    required: false
+  - name: ADO_PROJECT
+    required: false
+  - name: ADO_TEAM
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/bloodhound-enterprise/capability.yaml b/capabilities/bloodhound-enterprise/capability.yaml
index 8eca34c1..2826bbab 100644
--- a/capabilities/bloodhound-enterprise/capability.yaml
+++ b/capabilities/bloodhound-enterprise/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: bloodhound-enterprise
-version: "0.1.0"
+version: "0.1.1"
 description: >
   BloodHound Enterprise integration via the v2 REST API. HMAC-signed
   requests (long-lived integration) or JWT bearer (interactive); full
@@ -11,6 +11,20 @@ description: >
   — that one talks Bolt to a local CE Neo4j; this one talks REST to a
   hosted BHE deployment.
 
+secrets:
+  - name: BHE_JWT
+    required: false
+  - name: BHE_PASSWORD
+    required: false
+  - name: BHE_TOKEN_ID
+    required: false
+  - name: BHE_TOKEN_KEY
+    required: false
+  - name: BHE_USERNAME
+    required: false
+  - name: BLOODHOUND_URL
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/bloodhound/capability.yaml b/capabilities/bloodhound/capability.yaml
index d8372b80..6b373523 100644
--- a/capabilities/bloodhound/capability.yaml
+++ b/capabilities/bloodhound/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: bloodhound
-version: "1.0.0"
+version: "1.0.1"
 description: >
   BloodHound CE integration for Active Directory attack path analysis.
   Graph-based queries against Neo4j for domain enumeration, tier zero
@@ -14,6 +14,22 @@ mcp:
       args: ["run", "${CAPABILITY_ROOT}/mcp/server.py"]
       init_timeout: 30
 
+secrets:
+  - name: BLOODHOUND_PASSWORD
+    required: false
+  - name: BLOODHOUND_URL
+    required: false
+  - name: BLOODHOUND_USERNAME
+    required: false
+  - name: NEO4J_DATABASE
+    required: false
+  - name: NEO4J_PASSWORD
+    required: false
+  - name: NEO4J_URL
+    required: false
+  - name: NEO4J_USERNAME
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/ghostwriter-readonly/capability.yaml b/capabilities/ghostwriter-readonly/capability.yaml
index a453338d..9646b96f 100644
--- a/capabilities/ghostwriter-readonly/capability.yaml
+++ b/capabilities/ghostwriter-readonly/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: ghostwriter-readonly
-version: "1.0.1"
+version: "1.0.2"
 description: >
   Read-only GhostWriter integration. Query clients, projects, findings,
   objectives, targets, scope, deconflictions, evidence, observations,
@@ -19,6 +19,16 @@ mcp:
         GHOSTWRITER_USERNAME: "${GHOSTWRITER_USERNAME:-}"
         GHOSTWRITER_PASSWORD: "${GHOSTWRITER_PASSWORD:-}"
 
+secrets:
+  - name: GHOSTWRITER_API_TOKEN
+    required: false
+  - name: GHOSTWRITER_PASSWORD
+    required: false
+  - name: GHOSTWRITER_URL
+    required: false
+  - name: GHOSTWRITER_USERNAME
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/github/capability.yaml b/capabilities/github/capability.yaml
index 41be52b5..d420c90c 100644
--- a/capabilities/github/capability.yaml
+++ b/capabilities/github/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: github
-version: "1.0.0"
+version: "1.0.1"
 description: >
   Connect to GitHub from chat and agents — issues, pull requests, code
   search, Actions, releases, Dependabot, and code scanning. Bundles
@@ -34,6 +34,10 @@ mcp:
 skills:
   - skills/github/
 
+secrets:
+  - name: GITHUB_PAT
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/gitlab/capability.yaml b/capabilities/gitlab/capability.yaml
index d0531351..6a2598ef 100644
--- a/capabilities/gitlab/capability.yaml
+++ b/capabilities/gitlab/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: gitlab
-version: "1.0.0"
+version: "1.0.1"
 description: >
   Connect to GitLab (gitlab.com or self-managed) from chat and agents —
   issues, merge requests, projects, pipelines, milestones, wikis. Bundles
@@ -39,6 +39,12 @@ mcp:
 skills:
   - skills/gitlab/
 
+secrets:
+  - name: GITLAB_API_URL
+    required: false
+  - name: GITLAB_PAT
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/linear/capability.yaml b/capabilities/linear/capability.yaml
index 4131bbfd..abc76e22 100644
--- a/capabilities/linear/capability.yaml
+++ b/capabilities/linear/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: linear
-version: "1.0.0"
+version: "1.0.1"
 description: >
   Connect to Linear from chat and agents — search and read issues,
   projects, cycles, and teams; create and update issues; comment and
@@ -36,6 +36,10 @@ mcp:
 skills:
   - skills/linear/
 
+secrets:
+  - name: LINEAR_API_KEY
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/mythic-c2-readonly/capability.yaml b/capabilities/mythic-c2-readonly/capability.yaml
index 7befef65..0199dfbc 100644
--- a/capabilities/mythic-c2-readonly/capability.yaml
+++ b/capabilities/mythic-c2-readonly/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: mythic-c2-readonly
-version: "1.0.1"
+version: "1.0.2"
 description: >
   Read-only Mythic C2 integration. Query callbacks, task history (command
   input/output), credentials, downloaded files, artifacts, keylogs,
@@ -21,6 +21,18 @@ mcp:
         MYTHIC_API_TOKEN: "${MYTHIC_API_TOKEN:-}"
         MYTHIC_TIMEOUT: "${MYTHIC_TIMEOUT:-}"
 
+secrets:
+  - name: MYTHIC_API_TOKEN
+    required: false
+  - name: MYTHIC_PASSWORD
+    required: false
+  - name: MYTHIC_SERVER_IP
+    required: false
+  - name: MYTHIC_SERVER_PORT
+    required: false
+  - name: MYTHIC_USERNAME
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/mythic-c2/capability.yaml b/capabilities/mythic-c2/capability.yaml
index cc8aa31d..a1c5495d 100644
--- a/capabilities/mythic-c2/capability.yaml
+++ b/capabilities/mythic-c2/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: mythic-c2
-version: "2.1.1"
+version: "2.1.2"
 description: >
   Mythic C2 integration. Read-only observation (callbacks, tasks,
   credentials, files, artifacts, keylogs, screenshots, processes, tokens,
@@ -48,6 +48,18 @@ workers:
       MYTHIC_API_TOKEN: "${MYTHIC_API_TOKEN:-}"
       MYTHIC_TIMEOUT: "${MYTHIC_TIMEOUT:-}"
 
+secrets:
+  - name: MYTHIC_API_TOKEN
+    required: false
+  - name: MYTHIC_PASSWORD
+    required: false
+  - name: MYTHIC_SERVER_IP
+    required: false
+  - name: MYTHIC_SERVER_PORT
+    required: false
+  - name: MYTHIC_USERNAME
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/secure-software/capability.yaml b/capabilities/secure-software/capability.yaml
index 4f1d87aa..cc99402f 100644
--- a/capabilities/secure-software/capability.yaml
+++ b/capabilities/secure-software/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: secure-software
-version: "1.0.0"
+version: "1.0.1"
 description: >
   Package supply-chain analysis via ReversingLabs Spectra Assure
   (secure.software). Search the Community catalogue by purl or hash,
@@ -11,6 +11,18 @@ description: >
   YARA scanning. Chain secure.software findings with reversing tools
   (e.g. dotnet-reversing) to investigate suspicious packages.
 
+secrets:
+  - name: SPECTRA_ASSURE_GROUP
+    required: false
+  - name: SPECTRA_ASSURE_HOST
+    required: false
+  - name: SPECTRA_ASSURE_ORG
+    required: false
+  - name: SPECTRA_ASSURE_PATH
+    required: false
+  - name: SPECTRA_ASSURE_TOKEN
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/sliver-c2/capability.yaml b/capabilities/sliver-c2/capability.yaml
index fe38eade..85d686b4 100644
--- a/capabilities/sliver-c2/capability.yaml
+++ b/capabilities/sliver-c2/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: sliver-c2
-version: "1.0.2"
+version: "1.0.3"
 description: >
   Sliver C2 framework integration. Provides server management (session
   and beacon listing, listener creation, implant generation) and implant
@@ -14,6 +14,10 @@ mcp:
       args: ["run", "${CAPABILITY_ROOT}/mcp/server.py"]
       init_timeout: 30
 
+secrets:
+  - name: SLIVER_CONFIG_FILE
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io
diff --git a/capabilities/web-security/capability.yaml b/capabilities/web-security/capability.yaml
index 63672389..6bf7d09e 100644
--- a/capabilities/web-security/capability.yaml
+++ b/capabilities/web-security/capability.yaml
@@ -1,6 +1,6 @@
 schema: 1
 name: web-security
-version: "2.0.4"
+version: "2.0.5"
 description: >
   Web application penetration testing with 83 attack technique playbooks
   covering HTTP desync/request smuggling, cache poisoning, SSRF, SSTI, DOM
@@ -182,6 +182,70 @@ checks:
   - name: protoscope
     command: 'command -v protoscope >/dev/null 2>&1 || test -x "$HOME/go/bin/protoscope"'
 
+secrets:
+  - name: AGENTMAIL_API_KEY
+    required: false
+  - name: AGENTMAIL_BASE_URL
+    required: false
+  - name: CAIDO_ACCESS_TOKEN
+    required: false
+  - name: CAIDO_PAT
+    required: false
+  - name: CAIDO_PROXY
+    required: false
+  - name: CAIDO_URL
+    required: false
+  - name: CENSYS_API_KEY
+    required: false
+  - name: CENSYS_ORGANIZATION_ID
+    required: false
+  - name: CENSYS_PAT
+    required: false
+  - name: CF_ACCOUNT_ID
+    required: false
+  - name: CF_API_TOKEN
+    required: false
+  - name: CLOUDFLARE_ACCOUNT_ID
+    required: false
+  - name: CLOUDFLARE_API_TOKEN
+    required: false
+  - name: GITHUB_API_URL
+    required: false
+  - name: GITHUB_TOKEN
+    required: false
+  - name: H1_API_TOKEN
+    required: false
+  - name: H1_USERNAME
+    required: false
+  - name: INTERACTSH_SERVER
+    required: false
+  - name: JIRA_API_TOKEN
+    required: false
+  - name: JIRA_BASE_URL
+    required: false
+  - name: JIRA_EMAIL
+    required: false
+  - name: LINEAR_ACCESS_TOKEN
+    required: false
+  - name: LINEAR_API_KEY
+    required: false
+  - name: LINEAR_API_URL
+    required: false
+  - name: SECURITYCONTEXT_API_KEY
+    required: false
+  - name: SECURITYCONTEXT_URL
+    required: false
+  - name: SHODAN_API_KEY
+    required: false
+  - name: THERMOPTIC_PROXY_URL
+    required: false
+  - name: WEBHOOKSITE_API_KEY
+    required: false
+  - name: WEBHOOK_API_KEY
+    required: false
+  - name: WEBHOOK_SITE_API_KEY
+    required: false
+
 author:
   name: Dreadnode
   url: https://dreadnode.io