Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness.
Core Capabilities
.env and .env.example lifecycle guidance
Secret leak detection for repository working trees
Severity-based findings for likely credentials
Operational pointers for rotation and containment
Integration-ready outputs for CI checks
When to Use
Before pushing commits that touched env/config files
During security audits and incident triage
When onboarding contributors who need safe env conventions
When validating that no obvious secrets are hardcoded
Quick Start
# Scan a repository for likely secret leaks
python3 scripts/env_auditor.py /path/to/repo
# JSON output for CI pipelines
python3 scripts/env_auditor.py /path/to/repo --json
Recommended Workflow
Run scripts/env_auditor.py on the repository root.
Prioritize critical and high findings first.
Rotate real credentials and remove exposed values.
Update .env.example and .gitignore as needed.
Add or tighten pre-commit/CI secret scanning gates.
Reference Docs
references/validation-detection-rotation.md
references/secret-patterns.md
Common Pitfalls
Committing real values in .env.example
Rotating one system but missing downstream consumers
Logging secrets during debugging or incident response
Treating suspected leaks as low urgency without validation
Best Practices
Use a secret manager as the production source of truth.
Keep dev env files local and gitignored.
Enforce detection in CI before merge.
Re-test application paths immediately after credential rotation.
1---2name: env-secrets-manager-23description: Env & Secrets Manager4license: MIT5---6# Env & Secrets Manager78**Tier:** POWERFUL9**Category:** Engineering10**Domain:** Security / DevOps / Configuration Management1112---1314## Overview1516Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness.1718## Core Capabilities1920- `.env` and `.env.example` lifecycle guidance21- Secret leak detection for repository working trees22- Severity-based findings for likely credentials23- Operational pointers for rotation and containment24- Integration-ready outputs for CI checks2526---2728## When to Use2930- Before pushing commits that touched env/config files31- During security audits and incident triage32- When onboarding contributors who need safe env conventions33- When validating that no obvious secrets are hardcoded3435---3637## Quick Start3839```bash40# Scan a repository for likely secret leaks41python3 scripts/env_auditor.py /path/to/repo4243# JSON output for CI pipelines44python3 scripts/env_auditor.py /path/to/repo --json45```4647---4849## Recommended Workflow50511. Run `scripts/env_auditor.py` on the repository root.522. Prioritize `critical` and `high` findings first.533. Rotate real credentials and remove exposed values.544. Update `.env.example` and `.gitignore` as needed.555. Add or tighten pre-commit/CI secret scanning gates.5657---5859## Reference Docs6061- `references/validation-detection-rotation.md`62- `references/secret-patterns.md`6364---6566## Common Pitfalls6768- Committing real values in `.env.example`69- Rotating one system but missing downstream consumers70- Logging secrets during debugging or incident response71- Treating suspected leaks as low urgency without validation7273## Best Practices74751. Use a secret manager as the production source of truth.762. Keep dev env files local and gitignored.773. Enforce detection in CI before merge.784. Re-test application paths immediately after credential rotation.
Run npx skillmds@latest add jantoniofc/env-secrets-manager-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Env & Secrets Manager It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. Capability flags: executes scripts, reads secrets. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free. This skill is licensed under MIT.
JantonioFC (@jantoniofc) published this skill. Their other Agent Skills are listed on their SkillMD profile.
JantonioFC