{
  "skill_id": "gf-ops-secret-rotation-drill",
  "name": "Secret Rotation Drill Kit",
  "evaluation": "free",
  "quality": "agent-decision-grade",
  "functional": true,
  "price_usd": 8.49,
  "category": "Trust",
  "tier": "standard",
  "kind": "service",
  "tags": [
    "x402",
    "goods-factory",
    "service",
    "functional",
    "sealed-runtime",
    "gf-complete"
  ],
  "summary": "Tabletop and live secret-rotation drills for API keys, webhooks, and agent credentials with dual-run and revoke windows.",
  "when_to_use": [
    "API keys and webhook secrets have never been rotated outside of an emergency revoke.",
    "Agents, CI, and third-party integrations share credentials and you need a dual-run plan.",
    "Compliance or trust stakeholders ask for evidence of rotation drills, not just a password policy."
  ],
  "outline": [
    "Inventory secrets by system: CI tokens, webhook HMAC keys, agent API keys, DB URLs, and edge binding secrets with owners and last-rotated dates.",
    "Design dual-run windows: mint new secret, deploy consumers that accept both, verify, then revoke old with a hard deadline.",
    "Order consumer updates (CI → workers → agents → external webhooks) so nothing breaks mid-rotation.",
    "Run the drill with a clock: inject a fake compromised key scenario, execute dual-run, measure time-to-revoke and residual use.",
    "Score the drill: missed consumers, log evidence of old-key use, and file remediation tickets with owners and due dates."
  ],
  "capabilities": [
    "Secret inventory and ownership template with last-rotated tracking",
    "Dual-key acceptance patterns and revoke-window timers",
    "Consumer update ordering for CI, workers, agents, and webhooks",
    "Drill scorecard and residual-use evidence checklist"
  ],
  "artifact_outputs": [
    "secret-inventory-sheet.csv",
    "rotation-drill-runbook.md",
    "drill-scorecard.md"
  ],
  "decision_criteria": [
    "Outline steps are specific to this skill (not generic templates)",
    "Sealed pack exposes createSkill().run with outline-driven steps",
    "Artifacts are named concrete deliverables",
    "No revenue guarantees or banned claims",
    "Free eval path works without payment"
  ],
  "sealed_after_pay": [
    "Full src/index.js runtime (createSkill, run, plan)",
    "src/runbook.js with skill-specific steps",
    "src/tools.js registry for agent ToolRegistry",
    "WORKBOOK.md operator procedure",
    "templates/ checklist and artifact shells",
    "schemas/output.schema.json"
  ],
  "runtime": {
    "entry": "src/index.js",
    "export": "createSkill",
    "install": "node scripts/install-unlocked-pack.mjs unlock.json ./skills"
  },
  "challenge": "https://lvlltd.com/api/pay?skill=gf-ops-secret-rotation-drill",
  "sample": "https://lvlltd.com/skills/gf-ops-secret-rotation-drill/sample.md",
  "pack_meta": "https://lvlltd.com/api/packs?skill=gf-ops-secret-rotation-drill",
  "teaser": "https://lvlltd.com/sealed/gf-ops-secret-rotation-drill/",
  "proof": "https://lvlltd.com/api/proof",
  "standards": [
    "x402",
    "ERC-7857"
  ],
  "operator_notes": [
    "Confirm pay path with GET /api/pay before purchasing.",
    "Dry-run createSkill().run({ goal, dry_run: true }) after unlock.",
    "Persist payment.txHash with skill_id for re-redeem.",
    "Never commit private keys or OPS_SECRET into pack usage.",
    "Category focus: Trust. Kind: service.",
    "Claim scrub: no guaranteed ROI, no fake testimonials.",
    "If outline 404s on production, redeploy public/skills after completion pass."
  ]
}