Harness Secret Creation: A Skill for AI Agents

Where this fits

You're wiring up a new CI/CD pipeline and need to store a database password, an SSH key, and a cloud provider token. Doing this by hand means clicking through the Harness UI, pasting values, and hoping you didn't miss a permission. The create-secret skill turns that into a natural language request: your agent can list existing secrets, create new ones, and update metadata without you leaving your editor.

Why agents benefit

• List and inspect secrets – The agent can call harness_list and harness_get to see what's already stored, avoiding duplicates and checking metadata before making changes.
• Create multiple secret types – Supports SecretText, SecretFile, SSHKey, and WinRmCredentials, so it handles API keys, cert bundles, and remote access credentials in one flow.
• Pick the right secret manager – The skill knows how to route to Harness built-in, HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, or GCP Secret Manager based on your configuration.
• Update without exposing values – It updates metadata (like tags or descriptions) without pulling the actual secret value, keeping sensitive data out of the conversation.
• Trigger phrases map to actions – Phrases like "create secret" or "rotate SSH key" directly map to MCP v2 tool calls, so your agent doesn't need to guess the API shape.

Practical scenarios

Bootstrapping a new project

A developer asks the agent to "set up the API keys for the staging environment." The agent lists existing secrets, finds missing ones, and creates SecretText entries using the built-in manager—all while respecting naming conventions from your repo's config.

Rotating credentials in a pipeline

When a service account password expires, the agent can create a new secret version, update the reference in the pipeline YAML, and verify the change by listing secrets—no manual UI steps or copy-paste errors.

Managing SSH keys across environments

The skill handles SSHKey type secrets, so an agent can generate a key pair, store the private key as a secret, and attach the public key to a deployment target—ideal for multi-environment setups where keys vary per region.

Add it to your agent workflow

Install the skill with:

npx skills add harness/harness-skills --skill create-secret

Then instruct your agent to use it, for example:

Create a SecretText named "prod-db-password" with value "$(VAR)" and reference it in the deploy step.

The agent will call the MCP v2 tools to create the secret and update your pipeline definition.

Compare before adopting

Before you commit, check three things:

• Quality signals – The skill has 104 stars, is authored by Harness, and is Apache-2.0 licensed. Look for recent commits and issue responses.
• Maintenance freshness – Verify the repo is actively updated and the MCP server version matches your setup.
• Alternatives – You could write custom scripts or use the Harness API directly, but this skill encapsulates the patterns and reduces boilerplate. Also compare with other secret-management skills on OpenAgentSkill to see if a different one fits your stack.

Why it is worth tracking

This skill is a solid example of a vendor-backed agent capability that solves a real pain point: secret handling is often the first thing developers want to automate but fear to touch. The 104 stars and active maintenance from Harness signal that it's not a throwaway. Keep an eye on it as the MCP ecosystem matures—when you need to extend secret management beyond a single pipeline, this skill is a strong baseline to evaluate.