Is this key management scheme secure? I'm designing a scheme for management of a small number of cryptographic keys (&lt; 100 at any given time) and I had an idea: rather than storing all the keys, could I just store one master key and use a KDF to derive the particular key I need by varying the salt in a certain way? 

For example, if I need the second encryption key for usage X, I'd give something like PBKDF a salt of 

$$2||“encryption”||X||&lt;random value&gt;$$

which would uniquely derive the second version of that particular key.
You should not use a Password Based Key Derivation Function (PBKDF) for this. Instead you need a Key Based Key Derivation Function (KBKDF). You could use for instance NIST SP 800-108 (PDF) or HKDF. Both specify means for key derivation using some kind of context which is used as input for the KDF (e.g. a label or sequence number).

A salt is used in a similar fashion in PBKDF, but a salt has a different purpose than context data. Furthermore, it is not that likely that you need key strengthening which is delivered by the salt and iteration count commonly used in PBKDF's. If your master key is strong enough, then the derived keys should be safe without additional measures. PBKDF's are deliberately slow, KBKDF's aren't.

Note that KDF implementations may not be that widespread. They are however relatively easy to compose using the MAC or HMAC primitives that supply the necessary PRF functionality. If you go that way, don't forget to test against the available test vectors though.

If you go for the NIST defined KBKDF's I would advice for a counter mode KDF based on either HMAC using SHA-256 or AES-CMAC as they are easiest to implement and seem to be the most common implementations in the field.

[EDIT] When using HKDF it is advisable use use a Salt value even if your input key material (the master key) provides a lot of entropy. It is however not required for this use case. Neither do you have to use the extract function of HKDF, but normally you would want to perform it anyway for the sake of compatibility. Basically: only skip the Salt and extract function if you have strong resource constraints.