---
skill_id: gf-ops-secret-rotation-drill
evaluation: free
quality: agent-decision-grade
functional: true
price_usd_full: 8.49
price_label: $8.49 / unlock
kind: service
category: Trust
challenge: https://lvlltd.com/api/pay?skill=gf-ops-secret-rotation-drill
outline: https://lvlltd.com/skills/gf-ops-secret-rotation-drill/outline.json
runtime_after_unlock: src/index.js createSkill
standards: x402, ERC-7857
completion_pass: functional-v1
---

# Free sample — Secret Rotation Drill Kit

**Skill ID:** `gf-ops-secret-rotation-drill`  
**Unlock:** $8.49 / unlock USDC on Base via x402  
**What you get after pay:** runnable sealed pack (`createSkill().run`) + workbook + templates  

## Summary

Tabletop and live secret-rotation drills for API keys, webhooks, and agent credentials with dual-run and revoke windows.

Practice rotating secrets without outages. Includes inventory sheets, dual-key windows, consumer update order, revoke criteria, and drill scoring. Free outline + x402 unlock. Not legal advice; not a security audit certification.

## When to use

- API keys and webhook secrets have never been rotated outside of an emergency revoke.
- Agents, CI, and third-party integrations share credentials and you need a dual-run plan.
- Compliance or trust stakeholders ask for evidence of rotation drills, not just a password policy.

## Decision-grade outline (free)

1. Inventory secrets by system: CI tokens, webhook HMAC keys, agent API keys, DB URLs, and edge binding secrets with owners and last-rotated dates.
2. Design dual-run windows: mint new secret, deploy consumers that accept both, verify, then revoke old with a hard deadline.
3. Order consumer updates (CI → workers → agents → external webhooks) so nothing breaks mid-rotation.
4. Run the drill with a clock: inject a fake compromised key scenario, execute dual-run, measure time-to-revoke and residual use.
5. Score the drill: missed consumers, log evidence of old-key use, and file remediation tickets with owners and due dates.

## Capabilities

- Secret inventory and ownership template with last-rotated tracking
- Dual-key acceptance patterns and revoke-window timers
- Consumer update ordering for CI, workers, agents, and webhooks
- Drill scorecard and residual-use evidence checklist

## Artifacts after unlock

- `secret-inventory-sheet.csv`
- `rotation-drill-runbook.md`
- `drill-scorecard.md`

## Detailed description

Secrets rot in two ways: cryptographically, and organizationally. Most teams only rotate when a key leaks into a chat log—then they thrash every consumer at once. The Secret Rotation Drill Kit makes rotation a rehearsed trust practice. You start with an inventory that names every CI token, webhook signing secret, agent API key, database URL, and edge binding secret, plus an owner and last-rotated date so “we think it’s fine” stops being the control. Dual-run design is the core: mint the new secret, update systems to accept both, verify real traffic, then revoke the old key on a hard clock. Consumer order matters—CI and deploy paths first, then workers, then agents, then external webhook partners—so you do not strand a background job on a dead key. The live or tabletop drill injects a compromised-key scenario, forces dual-run and revoke under time pressure, and captures residual use from logs. A scorecard turns “we rotated” into measurable gaps: missed consumers, late revokes, missing owners. A free outline ships with the listing; the sealed pack unlocks via x402 Base USDC. This is operational security practice guidance only—not legal advice, not a penetration test, not a compliance certification, and it makes no guarantee of breach prevention. Use it so rotation is a drill, not a disaster.

## Functional runtime (paid)

After verified payment the sealed pack includes:

| Path | Role |
|------|------|
| `src/index.js` | `createSkill`, `run`, `plan`, `checklist` |
| `src/runbook.js` | Outline-driven steps with done_when |
| `src/tools.js` | Tool schemas for agent registries |
| `WORKBOOK.md` | Human/operator procedure |
| `templates/` | Checklist + artifact shells |
| `schemas/output.schema.json` | Result contract |

### Agent snippet (after unlock)

```js
import { createSkill } from "./src/index.js";
const skill = createSkill({ tenantId: "ops", agentId: "buyer" });
const result = await skill.run({
  goal: "Execute Secret Rotation Drill Kit for my catalog",
  context: { skill_id: "gf-ops-secret-rotation-drill" },
  dry_run: false,
});
// result.ok, result.steps, result.artifacts
```

## Pay path

1. Free: this sample + outline.json  
2. `GET https://lvlltd.com/api/pay?skill=gf-ops-secret-rotation-drill` → HTTP 402  
3. Transfer `maxAmountRequired` USDC to `payTo` on Base  
4. `POST /api/pay` with `X-PAYMENT: {"txHash":"0x…","skill":"gf-ops-secret-rotation-drill"}`  
5. Write `sealed_pack.files` to disk or use install-unlocked-pack.mjs  
6. Re-redeem anytime with the same verified txHash  

## Honesty

- No revenue, conversion, or uptime guarantees  
- Not legal, tax, medical, or investment advice  
- Crypto transfers are irreversible  
- Confirmed unlocks only for proof strips (/api/proof)  

*Public `/sealed/gf-ops-secret-rotation-drill/` is teaser-only. Full `src/` is paywalled under locked sealed delivery.*