How do I install the Sops Encrypt skill?

Run npx skillmds add majiayu000/sops-encrypt in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Sops Encrypt safe to use?

This skill has not completed SkillMD's automated safety review yet. Capability flags: makes network calls. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Sops Encrypt?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Sops Encrypt free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Sops Encrypt?

majiayu000 (@majiayu000) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Sops Encrypt by majiayu000 — Agent Skill

Name: Sops Encrypt
Rating: 4.666666666666667 (3 reviews)
Author: majiayu000

Sops Encrypt

Encrypt .env files using SOPS + age. Converts dotenv to YAML format (avoids SOPS bug #1435), then encrypts. Auto-detects unencrypted .env files. Use when user mentions "encrypt env", "sops encrypt", "encrypt secrets", "encrypt .env", "encrypt environment", "re-encrypt", "update encrypted".

majiayu000 41099f3 2 files · 3.2 KB Updated Sep 9, 2026 567 repo stars

File contents

SOPS Encrypt

Encrypt .env files by converting to YAML and encrypting with SOPS + age.

Why YAML? SOPS dotenv store has a known bug (#1435) that corrupts backslash and \n sequences. The helper script converts dotenv→YAML before encryption.

Workflow

Detect current state:

python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>

Verify prerequisites:
- tools.sops.installed must be true — if not, tell user to run /devtools:sops-setup
- project.sops_yaml.exists must be true — if not, tell user to run /devtools:sops-setup
- age_key.exists must be true — if not, tell user to run /devtools:sops-setup
Show unencrypted .env files from project.env_files. If empty, report "No .env files found to encrypt" and exit.
Use AskUserQuestion (multiSelect: true) — which files to encrypt. List each .env* file. If a corresponding .enc.yaml file already exists, note it will be overwritten.

Encrypt each selected file (convert dotenv→YAML, then encrypt):

python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/dotenv_yaml.py to-yaml <file> > <file>.enc.yaml.tmp
sops --encrypt <file>.enc.yaml.tmp > <file>.enc.yaml
rm <file>.enc.yaml.tmp

Example: .env.local → .env.local.enc.yaml

Verify each encrypted file exists and is non-empty.

Summary:

| File | Encrypted To | Status |
|------|-------------|--------|
| .env.local | .env.local.enc.yaml | done |
| .env.production | .env.production.enc.yaml | done |

Remind user to commit the .enc.yaml files.

Key Rules

Always verify .sops.yaml exists before attempting encryption
Always convert dotenv→YAML before encrypting (use the helper script)
Warn if an .enc.yaml file will be overwritten
Never delete the original .env file — only create the .enc.yaml copy
Clean up .tmp files even if encryption fails

---name: sops-encryptdescription: Encrypt .env files using SOPS + age. Converts dotenv to YAML format (avoids SOPS bug #1435), then encrypts. Auto-detects unencrypted .env files. Use when user mentions "encrypt env", "sops encrypt", "encrypt secrets", "encrypt .env", "encrypt environment", "re-encrypt", "update encrypted".--- # SOPS Encrypt Encrypt `.env` files by converting to YAML and encrypting with SOPS + age. **Why YAML?** SOPS dotenv store has a [known bug (#1435)](https://github.com/getsops/sops/issues/1435) that corrupts backslash and `\n` sequences. The helper script converts dotenv→YAML before encryption. ## Workflow 1. **Detect current state**: ```bash python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root> ``` 2. **Verify prerequisites**: - `tools.sops.installed` must be true — if not, tell user to run `/devtools:sops-setup` - `project.sops_yaml.exists` must be true — if not, tell user to run `/devtools:sops-setup` - `age_key.exists` must be true — if not, tell user to run `/devtools:sops-setup` 3. **Show unencrypted .env files** from `project.env_files`. If empty, report "No .env files found to encrypt" and exit. 4. **Use `AskUserQuestion`** (multiSelect: true) — which files to encrypt. List each `.env*` file. If a corresponding `.enc.yaml` file already exists, note it will be overwritten. 5. **Encrypt each selected file** (convert dotenv→YAML, then encrypt): ```bash python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/dotenv_yaml.py to-yaml <file> > <file>.enc.yaml.tmp sops --encrypt <file>.enc.yaml.tmp > <file>.enc.yaml rm <file>.enc.yaml.tmp ``` Example: `.env.local` → `.env.local.enc.yaml` 6. **Verify** each encrypted file exists and is non-empty. 7. **Summary**: ``` | File | Encrypted To | Status | |------|-------------|--------| | .env.local | .env.local.enc.yaml | done | | .env.production | .env.production.enc.yaml | done | ``` Remind user to commit the `.enc.yaml` files. ## Key Rules - Always verify `.sops.yaml` exists before attempting encryption - Always convert dotenv→YAML before encrypting (use the helper script) - Warn if an `.enc.yaml` file will be overwritten - Never delete the original `.env` file — only create the `.enc.yaml` copy - Clean up `.tmp` files even if encryption fails

Frequently asked questions