Azure Key Vault Secrets for TypeScript
Securely store and retrieve application secrets in Azure Key Vault while managing key lifecycles from Node.js.
The documentation recommends managed identity, least-privilege RBAC, soft delete, and recovery, and labels purge as irreversible. However, examples cover reading, exporting, backing up, deleting, and cryptographic operations without user-confirmation requirements; bulk export can expose all secrets, and data-flow, logging, and backup-storage risks are underexplained, so points are deducted.
Common CRUD, polling, and partial error-handling paths are documented, but the main file uses KeyClient without importing it, while installation omits @azure/keyvault-keys; the references broaden the scope to keys and cryptography. No skill-specific committed tests or reproducible execution evidence are shown, so the static cap keeps this below 10.
The primary scenario is reasonably clear: managing Azure Key Vault secrets from Node.js/TypeScript. The content also covers keys and cryptography, making boundaries less precise. Browser non-support is stated, but input constraints, trigger conditions, non-fit cases, and Chinese/mainland-China environment support are not described, so points are deducted.
The skill has front matter, an MIT license, a version, installation notes, topical references, error handling, and best practices. It lacks skill-specific ownership, changelog, SDK version constraints, FAQs, and compatibility notes; the main file and references also differ in scope and dependencies, so points are deducted.
It supplies directly adaptable examples for secrets, keys, rotation, recovery, backup, and encryption, giving the skill clear core value. However, the missing dependency, import defect, and incomplete production safeguards require substantial manual verification, so static effectiveness is capped at 7.
The files include concrete APIs, permission tables, and error codes, and the repository provides generic CI/evaluation infrastructure. No path-specific tests, pinned SDK versions, execution results, or independent corroboration are provided, so only limited static auditability is credited.
- Add @azure/keyvault-keys to installation and fix imports such as KeyClient; otherwise the main examples may not compile.
- Treat bulk export, backup, deletion, and purge as high-risk operations. Apply least privilege, user confirmation, auditing, and recovery controls, and avoid printing or persisting secret values.
- Before production use, verify current Azure SDK APIs, RBAC permissions, soft-delete/purge-protection requirements, and network reachability; this review did not execute the code.
What does this skill do, and when should you use it?
This skill supports TypeScript and Node.js developers using the Azure Key Vault Secrets JavaScript SDK. It covers creating, retrieving, listing, deleting, recovering, purging, backing up, and restoring secrets, plus key creation, rotation, deletion, and cryptographic operations. Authentication guidance uses DefaultAzureCredential or managed identity credentials. The skill is explicitly Node.js-only and does not support browsers.
Shows how to install @azure/keyvault-secrets and @azure/identity, configure a vault URL or name, and set authentication environment variables; use SecretClient to create, retrieve, list, delete, recover, purge, back up, and restore secrets; use KeyClient to create, retrieve, list, rotate, delete, and back up keys; use CryptographyClient for encryption, decryption, signing, verification, key wrapping, and unwrapping; and apply error handling, expiration dates, soft delete, rotation policies, and least-privilege key operations.
- A TypeScript developer building a Node.js backend that must read application passwords, API keys, or configuration values from Azure Key Vault.
- An Azure application team configuring managed identity or DefaultAzureCredential for production authentication.
- A developer creating RSA or elliptic-curve keys with expiration dates, tags, and restricted key operations.
- A platform or operations engineer implementing key rotation, soft-delete recovery, purge, or backup-and-restore workflows.
- A Node.js developer implementing encryption, decryption, signing, verification, or key wrapping through Azure Key Vault.
What are this skill's strengths and limitations?
- Covers concrete SDK patterns for secrets, key lifecycle management, cryptography, and backup and restore.
- Includes examples for DefaultAzureCredential, ManagedIdentityCredential, environment variables, and error handling.
- Addresses production concerns including soft delete, expiration, rotation policies, and limiting key operations.
- MIT licensed and maintained within a repository described as actively developed with testing workflows.
- Explicitly targets Node.js and does not support browsers.
- The source provides no test-coverage or acceptance-scenario evidence for this individual skill.
- The key and CryptographyClient examples require `@azure/keyvault-keys`, but the provided install command does not install it.
- The authentication snippet uses KeyClient without showing its corresponding import.
How do you install this skill?
Install the skill collection with npx skills add microsoft/skills, then select this skill in the wizard. The README says skills are installed into the selected Agent directory, such as .github/skills/ for GitHub Copilot. Install the SDK dependencies with npm install @azure/keyvault-secrets @azure/identity. The source does not document a standalone package or complete project-directory setup for this skill.
How do you use this skill?
With the skill installed, give the coding Agent a concrete request such as: “Using TypeScript and the Azure Key Vault Secrets SDK, retrieve the latest version of MySecret with DefaultAzureCredential and handle SecretNotFound.” Configure KEY_VAULT_URL or AZURE_KEYVAULT_NAME; when using DefaultAzureCredential in production, also set AZURE_TOKEN_CREDENTIALS=prod or a specific credential value. The key and cryptography examples also use @azure/keyvault-keys, although the installation command does not include it.