--- title: "Infisical PKI: review, setup & limitations · Undominated.ai" canonical: https://undominated.ai/skills/infisical-pki/ description: "Pins Infisical's certificate-management skill and its rule to send SSH certificates to a different skill." --- # Infisical PKI: review, setup & limitations · Undominated.ai > Pins Infisical's certificate-management skill and its rule to send SSH certificates to a different skill. [← Explore all skills](/skills/) SECURITY / Infisical Inc. # Infisical PKI Pins Infisical's certificate-management skill and its rule to send SSH certificates to a different skill. [See setup guidance ↓](#setup)[Original source ↗](https://github.com/Infisical/ai-skills/tree/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-pki) SOURCE REVIEW Reviewed 2026-10-14 Evidence 3 linked sources Publisher Infisical Inc. Licence [MIT ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE) Revision d7e7fa443893 [Read what was—and wasn’t—checked ↓](#review) “Separates Infisical certificate management from secrets, SSH certificates, and KMS, and says ACME, EST, and SCEP clients keep the private key.” [Infisical Inc. · upstream description ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-pki/SKILL.md) Our analysis follows below. 01 / THE REASONING ## Why this made the selection. - The catalogue has Infisical secret scanning and not this PKI skill. - The file routes SSH certificates, stored secret values, and KMS encryption away from the PKI product so those are not treated as the same API. ### A good fit for - Deciding whether an Infisical certificate task belongs in the PKI product or in dynamic secrets or KMS ### Weigh up before choosing - This review did not execute the resource. - The skill tells the agent to read bundled references for enum values. Those reference files were not fetched, so the wire-value examples were not checked against them. - The README's recommended path is the hosted docs MCP, not this skill. The skill install is labeled as the alternative. 02 / THE REVIEW RECORD ## What we actually inspected. Source review has boundaries. A clear record is more useful than a “safe” badge. ### Material inspected - skills/infisical-pki/SKILL.md - README.md - LICENSE ### Our findings - The skill says certificate management is a separate product from secrets management and uses the cert-manager project type. - It says an SSH certificate request belongs in infisical-dynamic-secrets, not in this PKI skill. - It says ACME, EST, and SCEP clients generate the private key and Infisical sees the CSR, and it says not to print private key material beyond a placeholder. ### Not established by this review - The resource was not executed and its tools were not called. - No Infisical API was called. - The bundled references named by the skill were not opened. The review applies to the material and revision named here. A newer upstream release can change its behavior. 03 / PUT IT TO WORK ## Add a skill to your workflow. [Upstream setup instructions ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md) DOCUMENTED COMMAND npx skills add Infisical/ai-skills Copy command ↗ Run in your terminal to choose your AI tools, project or global scope, and installation method. This short command follows the current upstream version; the review covers the revision shown above. - The README first recommends the hosted docs MCP at https://infisical.com/docs/mcp. - The skills alternative is the command above. - The Claude Code marketplace line in the same file is /plugin marketplace add Infisical/ai-skills. ### Before you start - A skills-compatible agent, or an MCP client if the docs server is used instead - An Infisical project if certificates are actually issued ### Compatibility skills CLI · Claude Code ### Guidance that says private keys stay on the client for ACME, EST, and SCEP - Read the skill - Issue certificates only with credentials the operator supplies - Do not treat this file as permission to print a private key ### Cost model MIT; no certificate was issued 04 / FOLLOW THE EVIDENCE ## The source trail. Our notes are separate from the original resource. Check upstream before adopting a new version. - [infisical-pki SKILL.md ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-pki/SKILL.md) Checked 2026-10-14 https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/skills/infisical-pki/SKILL.md Supports: product boundary and private-key rule - [Repository README ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md) Checked 2026-10-14 https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/README.md Supports: docs MCP recommendation and skills install line - [Repository LICENSE ↗](https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE) Checked 2026-10-14 https://github.com/Infisical/ai-skills/blob/d7e7fa443893d7ba10895f926407da27751ea096/LICENSE Supports: MIT License KEEP COMPARING ## Other approaches to consider. Related by category or shared topics. These are alternatives to inspect, not a measured quality order. [### Infisical secret scanning ↗ Infisical skill for scanning GitHub, GitLab, and Bitbucket history for leaked credentials, with GitHub tied to a github-radar connection and rotation required before history is rewritten.](/skills/infisical-secret-scanning/)[### Burp Project Parser ↗ Extract and search captured Burp traffic while distinguishing empty results from parser startup failures.](/skills/trailofbits-burpsuite-project-parser/)[### C and C++ Security Review ↗ Coordinate scoped native C/C++ security review and assemble findings with an explicit coverage ledger.](/skills/trailofbits-c-review/) [AI Tools ↗](/tools/)[Skills ↗](/skills/)[Agents ↗](/agents/)[MCP Servers ↗](/mcp-servers/)[Workflows ↗](/workflows/) ## Continue your investigation - [Choose a toolkit](/tools/) - [Inspect execution hosts](/agents/) - [Check tool access](/mcp-servers/) - [Check project dependencies](/check-repo/)