profiles-and-credentialslisted

# Profiles & Credentials — shared pattern reference Reference skill describing the credential / profile / confirmation pattern used by all claude-team-toolkit skills (azure-devops, fastlane, firebase, heroku, k6, maestro, postgres, rspec, sentry, shopify, slack, trello, etc.). Implementation lives in [`lib/credentials.sh`](../../lib/credentials.sh) and [`lib/confirm.sh`](../../lib/confirm.sh). ## Overview All credential-bearing skills share a uniform pattern: - INI credentials at `~/.<service>/credentials` (mode 600) - Multiple `[profile]` sections per file (e.g., `[default]`, `[work]`, `[prod]`) - Resolution order: `--profile <name>` flag → `<SERVICE>_PROFILE` env → `~/.<service>/active_profile` → `[default]` - Helper sourced from `lib/credentials.sh` populates `CTT_<KEY>` env vars - Destructive ops gated by `ctt_confirm` from `lib/confirm.sh` - Actions audit-logged to `~/.claude-team-toolkit/audit.log` (key NAMES only, never values) ## When to Use - Authoring a NEW skill that needs per-account/per-org/per-env switching - Modifying credential loading in an existing skill - Adding destructive operations that need typed confirmation - Debugging why a skill picks the wrong profile - Reviewing security posture of a skill ## When NOT to Use - One-off scripts not meant for reuse → just hardcode and move on - Skills with no credentials (e.g., `react-native`, `rails-security`) → nothing to load - Cross-cloud unified credential systems → use the cloud's native config (`~/.aws