Parimal Deshmukh af9a95cce5 feat: add secret-safety guardrail for AWS Secrets Manager (#65) ...

Prevents AI agents from pulling plaintext secret values into their context.
Agents reference secrets with {{resolve:secretsmanager:NAME}}, which the
asm-exec wrapper resolves at runtime so the value reaches the target command
but never the model.

- PreToolUse plugin hook blocks get-secret-value / batch-get-secret-value
  across the AWS CLI, SDK/boto3, MCP tools, and direct SMA access.
- aws-secrets-manager skill documents the resolve syntax and asm-exec usage.
- asm-exec resolves references via the Secrets Manager Agent or the AWS MCP
  endpoint (SigV4-signed, stdlib-only), with no local plaintext fallback.

Best-effort defense, not a security boundary; pair with IAM least-privilege,
CloudTrail, and VPC endpoint policies.

2026-06-17 14:05:29 +00:00

..

aws-agent-rules.md

feat: add secret-safety guardrail for AWS Secrets Manager (#65)

2026-06-17 14:05:29 +00:00