---
name: Harness Secrets
slug: harness-secrets
category: DevOps
description: Harness Secrets checks GCP Secret Manager setup, fetches secret values, and validates an NPM token with npm whoami. Use it to rotate publish-time secrets without long-lived CI keys.
github: "https://github.com/ruvnet/metaharness/tree/main/.claude-plugin/skills/harness-secrets"
language: TypeScript
stars: 609
forks: 72
install: "npx degit https://github.com/ruvnet/metaharness/tree/main/.claude-plugin/skills/harness-secrets ~/.claude/skills/harness-secrets"
installs_to: ~/.claude/skills/harness-secrets
source_path: .claude-plugin/skills/harness-secrets/SKILL.md
collection_size: 16
category_size: 798
collection_url: "https://dirskills.com/collections/ruvnet/metaharness"
added: 2026-08-25T05:12:52.214Z
last_synced: 2026-08-25T05:12:52.214Z
canonical_url: "https://dirskills.com/skills/harness-secrets"
---

# Harness Secrets

Harness Secrets checks GCP Secret Manager setup, fetches secret values, and validates an NPM token with npm whoami. Use it to rotate publish-time secrets without long-lived CI keys.

**Install:**

```bash
npx degit https://github.com/ruvnet/metaharness/tree/main/.claude-plugin/skills/harness-secrets ~/.claude/skills/harness-secrets
```

## README

# harness-secrets

> Codex skill for GCP Secret Manager — check / fetch / validate-token.

## Modes

### check
Validates the full GCP setup (`gcloud` on PATH, active project, auth principal, secret exists, WIF pool present). Use this when bootstrapping a new GCP project for publish.

```
/harness-secrets mode=check
/harness-secrets mode=check secret=NPM_TOKEN_DEV
/harness-secrets mode=check project=my-gcp-project secret=NPM_TOKEN
```

### fetch
Fetches a secret value to stdout. Use in pipelines:

```
/harness-secrets mode=fetch secret=NPM_TOKEN
/harness-secrets mode=fetch secret=GH_TOKEN version=3
```

### validate-token
Fetches `NPM_TOKEN` and runs `npm whoami` against the registry. No publish — just confirms the token isn't revoked. Use this BEFORE you tag a release.

```
/harness-secrets mode=validate-token
/harness-secrets mode=validate-token secret=NPM_TOKEN_STAGING
```

## Equivalent CLI

```bash
harness secrets check --secret=NPM_TOKEN
harness secrets fetch NPM_TOKEN --version=3
harness secrets validate-token
```

## Why this exists

So you can refresh + verify the publish-time GCP secret WITHOUT triggering a real publish.