chore: add Claude Code skill for safely extracting Actions secrets

Document the RSA-OAEP encrypted-dump pattern used to recover the
cleartext values of repository secrets when the original source isn't
available — e.g. when mirroring values from the Actions store into the
Dependabot store after enabling pull_request_target. The skill captures
the full playbook (keypair → temp workflow step → PR → log scrape →
local decrypt → force-push removal) plus the threat model, when to
refuse, and rationale for RSA-OAEP over alternatives.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: ionmincu

.claude/skills/extract-actions-secrets/SKILL.md

@@ -0,0 +1,198 @@
+---
+name: extract-actions-secrets
+description: Recover the cleartext values of GitHub Actions repository secrets from a repo the user controls — e.g. to mirror them into the Dependabot secrets store, copy them to another repo, or back them up to a password manager. Uses an RSA-OAEP-encrypted dump emitted by a temporary workflow step, decrypted locally with a maintainer-held private key, then the commit is force-removed. ONLY for repos where the user has admin/maintainer access. Triggers — explicit user requests like "extract the secrets", "get the values from the Actions secret store", "mirror Actions secrets to Dependabot store", "I lost the value of REPO_SECRET_X and need it back".
+---
+
+# Extract GitHub Actions secrets safely
+
+GitHub does not expose Actions secret values via API/CLI/UI by design. The only way to retrieve a value is to have a workflow step read it at runtime. This skill does that with an encrypted, single-shot pattern that minimizes blast radius.
+
+## When this is the right approach
+
+- User has maintainer/admin access to the repo (writes branch, can open PRs).
+- Original source of the secret is **not** recoverable (UiPath portal / vault / password manager doesn't have it, or whoever set it isn't reachable).
+- User cannot rotate the credential (rotation would make extraction unnecessary — prefer rotation when possible).
+
+## When to refuse / steer the user away
+
+- Repo is not the user's. Do not run this on third-party repos under any framing.
+- The credential is rotatable. Suggest **rotate, write both stores fresh**. It's cleaner: no exfiltration, no log traces.
+- The value is recoverable from the originating system (cloud console, internal vault). Suggest reading from source instead.
+
+## Threat model — what you accept by doing this
+
+1. **Workflow logs contain encrypted ciphertext + the public key.** Useless without the private key, but it's a trace. Delete the workflow run after if you care.
+2. **The temporary commit's SHA remains accessible via direct URL** for ~90 days after force-removal, until GitHub garbage-collects. Not visible in PR/branch history but the commit object exists.
+3. **Force-push rewrites the PR branch.** Coordinate with reviewers if the PR is already under review.
+4. **Private key on the maintainer's laptop.** Treat it like any other secret-holding key: delete after use, never commit.
+
+## Playbook
+
+### Step 1 — Generate a keypair on the maintainer's laptop
+
+```bash
+WORKDIR="$HOME/.exfil-keys/$(basename "$PWD")"
+mkdir -p "$WORKDIR"
+openssl genrsa -out "$WORKDIR/private.pem" 4096
+openssl rsa -in "$WORKDIR/private.pem" -pubout -out "$WORKDIR/public.pem"
+chmod 600 "$WORKDIR/private.pem"
+cat "$WORKDIR/public.pem"
+```
+
+The private key never leaves the laptop. The public PEM gets inlined into the workflow step below.
+
+### Step 2 — Identify the secrets to extract
+
+```bash
+grep -oE 'secrets\.[A-Z0-9_]+' .github/workflows/*.yml | sort -u
+```
+
+Pick the ones you need. List them by their `secrets.NAME` identifier.
+
+### Step 3 — Add a temporary workflow step
+
+Find a job that already runs with secrets in scope on `pull_request` events (typically an integration-tests / e2e job — anything that already reads from `secrets.*`). Add a step **before** the main test step:
+
+```yaml
+- name: Encrypt and emit secrets for one-shot exfiltration (TEMPORARY — REMOVE)
+  if: github.event_name != 'push' && <SCOPE CONDITION TO RUN ONCE>
+  shell: bash
+  env:
+    PUBKEY: |
+      -----BEGIN PUBLIC KEY-----
+      <PASTE THE PUBLIC PEM CONTENTS HERE, KEEPING EACH LINE INDENTED UNDER PUBKEY>
+      -----END PUBLIC KEY-----
+    # One env var per secret you want to extract. Use the same names you grepped.
+    SECRET_A: ${{ secrets.SECRET_A }}
+    SECRET_B: ${{ secrets.SECRET_B }}
+  run: |
+    command -v openssl >/dev/null || { apt-get update -qq && apt-get install -y -qq openssl; }
+    echo "$PUBKEY" > /tmp/pubkey.pem
+
+    emit() {
+      local name="$1"
+      local value="$2"
+      if [ -z "$value" ]; then
+        echo "::warning::$name is empty; skipping"
+        return
+      fi
+      local b64
+      b64=$(printf '%s' "$value" \
+        | openssl pkeyutl -encrypt -pubin -inkey /tmp/pubkey.pem \
+            -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256 \
+        | base64 -w0)
+      echo "ENCRYPTED <label>.$name=$b64"
+    }
+
+    emit SECRET_A "$SECRET_A"
+    emit SECRET_B "$SECRET_B"
+
+    rm -f /tmp/pubkey.pem
+```
+
+Replace `<label>` with a tag for grouping (e.g. `alpha`, `staging`, `prod`). Replace `<SCOPE CONDITION TO RUN ONCE>` with whatever scopes this to a single matrix slot — e.g. `matrix.testcase == 'datetime-server' && matrix.environment == 'alpha'`. Without that, the step runs once per matrix entry and floods the log.
+
+Notes on the YAML:
+- `shell: bash` is required if the job's container image lacks bash on the default shell path (it'll fall back to `sh -e` which doesn't support `local`/arrays/heredoc).
+- RSA-OAEP-4096 max payload is ~446 bytes — fine for OAuth client secrets, GUIDs, URLs. For larger payloads, switch to a hybrid scheme (random AES key encrypted with RSA, then payload encrypted with AES).
+- `if: github.event_name != 'push'` keeps it from running on direct pushes to main, just in case.
+
+### Step 4 — Commit & push, ensure a PR exists
+
+```bash
+git checkout -b exfil/<scope-name>
+git add .github/workflows/<the-workflow>.yml
+git commit -m "ci: TEMPORARY — emit RSA-OAEP encrypted secrets (REMOVE)"
+git push -u origin exfil/<scope-name>
+gh pr create --title "ci: temporary secret exfiltration" --body "Will be force-removed."
+```
+
+A PR is required (not a direct push) so the `pull_request` event fires and secrets are in scope. (Or use any existing PR's branch — push the temp commit there, run it, then revert.)
+
+### Step 5 — Wait for the target job to finish
+
+```bash
+gh run list --branch exfil/<scope-name> --workflow=<workflow.yml> --limit 1
+# Note the run ID
+gh run view <run-id> --json jobs | jq '.jobs[] | {name, databaseId, status, conclusion}'
+# Pick the job that contained your encryption step. Poll:
+until [ "$(gh api repos/<owner>/<repo>/actions/jobs/<job-id> --jq '.status')" = "completed" ]; do
+  sleep 15
+done
+```
+
+### Step 6 — Pull encrypted lines from the log
+
+```bash
+gh api repos/<owner>/<repo>/actions/jobs/<job-id>/logs \
+  | grep -oE 'ENCRYPTED [a-z_]+\.[A-Z_]+=[A-Za-z0-9+/=]+' \
+  > "$WORKDIR/encrypted.txt"
+wc -l "$WORKDIR/encrypted.txt"
+awk -F= '{print $1}' "$WORKDIR/encrypted.txt"
+```
+
+The tighter `grep -oE` pattern matters — a looser pattern matches the echoed script source as well.
+
+### Step 7 — Decrypt locally
+
+```bash
+IN="$WORKDIR/encrypted.txt" OUT="$WORKDIR/decrypted.txt" KEY="$WORKDIR/private.pem" bash -c '
+set -euo pipefail
+: > "$OUT"
+count=0
+while IFS= read -r line || [ -n "$line" ]; do
+  # Strip trailing CR if the input has CRLF line endings (common on Windows)
+  line="${line%$'"'"'\r'"'"'}"
+  [ -z "$line" ] && continue
+  case "$line" in "ENCRYPTED "*) ;; *) continue ;; esac
+  name="${line#ENCRYPTED }"
+  b64="${name#*=}"
+  name="${name%%=*}"
+  cleartext=$(printf "%s" "$b64" | base64 -d | openssl pkeyutl -decrypt \
+    -inkey "$KEY" \
+    -pkeyopt rsa_padding_mode:oaep -pkeyopt rsa_oaep_md:sha256)
+  printf "%s=%s\n" "$name" "$cleartext" >> "$OUT"
+  count=$((count + 1))
+done < "$IN"
+chmod 600 "$OUT"
+echo "Decrypted $count value(s) into $OUT"
+'
+```
+
+Inspect `$WORKDIR/decrypted.txt` in an editor — do not `cat` or pipe it through chat/logs.
+
+### Step 8 — Verify, then clean up (all three)
+
+1. **Mirror the values** wherever they need to go (Dependabot store, another repo, password manager). Test that at least one credential works before destroying anything.
+
+2. **Force-remove the commit** from the branch:
+   ```bash
+   git reset --hard HEAD~1
+   git push --force-with-lease
+   ```
+
+3. **Optionally delete the workflow run** so the encrypted log lines don't sit around:
+   ```bash
+   gh run delete <run-id>
+   ```
+
+4. **Delete the private key:**
+   ```bash
+   rm -rf "$WORKDIR"
+   ```
+
+## Variations
+
+- **Multiple labels in one shot:** repeat the env block per environment (`ALPHA_*`, `STAGING_*`, `CLOUD_*`) and call `emit alpha.SECRET_X "$ALPHA_X"` etc. One step, one log section, one decrypt pass.
+- **No suitable secret-bearing job exists yet:** add a one-off job `if: github.event_name == 'pull_request'` with the secrets you need. Still scope by a single matrix entry if applicable.
+- **Repo is private and logs are restricted to org members:** the encryption is still worth doing — defense-in-depth — but the urgency is lower.
+
+## Why not just write secrets to an artifact?
+
+Workflow artifacts on public repos are **publicly downloadable by any authenticated GitHub user**. GitHub Actions masks secrets in log output but does *not* mask the content of files written by steps or uploaded as artifacts. A plaintext artifact on a public repo is a leak. The encrypted-log approach avoids this — even if a stranger scrapes the log, they get ciphertext.
+
+## Why RSA-OAEP and not symmetric / age / GPG?
+
+- **age** is cleanest but requires the binary, which isn't pre-installed in most CI images.
+- **GPG** is heavy; key management is fussy.
+- **OpenSSL with RSA-OAEP** is universally pre-installed (or trivially `apt-get install`-able on Debian-based runners) and `openssl pkeyutl` is a one-liner. The payloads here are small enough that RSA's size limit isn't a problem.