How do I install the Env Secrets Manager skill?

Run npx skillmds@latest add neekware/env-secrets-manager-2 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Env Secrets Manager skill do?

Env & Secrets Manager It is listed under Coding & Dev Tools on SkillMD.

Is Env Secrets Manager safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: PASS, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Env Secrets Manager?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Env Secrets Manager free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Env Secrets Manager?

neekware (@neekware) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Env Secrets Manager by neekware — Agent Skill

Name: Env Secrets Manager
Author: neekware

File contents

Env & Secrets Manager

Tier: POWERFUL Category: Engineering Domain: Security / DevOps / Configuration Management

Overview

Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness.

Core Capabilities

.env and .env.example lifecycle guidance
Secret leak detection for repository working trees
Severity-based findings for likely credentials
Operational pointers for rotation and containment
Integration-ready outputs for CI checks

When to Use

Before pushing commits that touched env/config files
During security audits and incident triage
When onboarding contributors who need safe env conventions
When validating that no obvious secrets are hardcoded

Quick Start

# Scan a repository for likely secret leaks
python3 scripts/env_auditor.py /path/to/repo

# JSON output for CI pipelines
python3 scripts/env_auditor.py /path/to/repo --json

Recommended Workflow

Run scripts/env_auditor.py on the repository root.
Prioritize critical and high findings first.
Rotate real credentials and remove exposed values.
Update .env.example and .gitignore as needed.
Add or tighten pre-commit/CI secret scanning gates.

Note: Bundled scripts ship as Markdown reference (.md) — copy the code out of the .md file to run it.

Reference Docs

references/validation-detection-rotation.md
references/secret-patterns.md

Common Pitfalls

Committing real values in .env.example
Rotating one system but missing downstream consumers
Logging secrets during debugging or incident response
Treating suspected leaks as low urgency without validation

Best Practices

Use a secret manager as the production source of truth.
Keep dev env files local and gitignored.
Enforce detection in CI before merge.
Re-test application paths immediately after credential rotation.

Creator: Engineering License: MIT Source Repo: neekware/dojo-skills Source Bucket: engineering Original Path: engineering/env-secrets-manager

---name: env-secrets-manager-2description: Env & Secrets Manager---# Env & Secrets Manager**Tier:** POWERFUL**Category:** Engineering**Domain:** Security / DevOps / Configuration Management---## OverviewManage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness.## Core Capabilities- `.env` and `.env.example` lifecycle guidance- Secret leak detection for repository working trees- Severity-based findings for likely credentials- Operational pointers for rotation and containment- Integration-ready outputs for CI checks---## When to Use- Before pushing commits that touched env/config files- During security audits and incident triage- When onboarding contributors who need safe env conventions- When validating that no obvious secrets are hardcoded---## Quick Start```bash# Scan a repository for likely secret leakspython3 scripts/env_auditor.py /path/to/repo# JSON output for CI pipelinespython3 scripts/env_auditor.py /path/to/repo --json```---## Recommended Workflow1. Run `scripts/env_auditor.py` on the repository root.2. Prioritize `critical` and `high` findings first.3. Rotate real credentials and remove exposed values.4. Update `.env.example` and `.gitignore` as needed.5. Add or tighten pre-commit/CI secret scanning gates.> **Note:** Bundled scripts ship as Markdown reference (`.md`) — copy the code out of the `.md` file to run it.---## Reference Docs- `references/validation-detection-rotation.md`- `references/secret-patterns.md`---## Common Pitfalls- Committing real values in `.env.example`- Rotating one system but missing downstream consumers- Logging secrets during debugging or incident response- Treating suspected leaks as low urgency without validation## Best Practices1. Use a secret manager as the production source of truth.2. Keep dev env files local and gitignored.3. Enforce detection in CI before merge.4. Re-test application paths immediately after credential rotation.> **Creator:** Engineering> **License:** MIT> **Source Repo:** `neekware/dojo-skills`> **Source Bucket:** `engineering`> **Original Path:** `engineering/env-secrets-manager`

Frequently asked questions

Env Secrets Manager