How do I install the Env Drift skill?

Run npx skillmds@latest add starr-del/env-drift in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Env Drift safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Env Drift?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Env Drift free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Env Drift?

Starr-del (@starr-del) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Env Drift by starr-del — Agent Skill

Name: Env Drift
Author: Starr-del

Env Drift

Find environment-variable drift between code, .env files, .env.example, and platform config (vercel.json / netlify.toml). Use whenever a deploy fails with undefined env vars, the user mentions 'missing environment variable', 'works locally but env is undefined in prod', sets up a new deploy environment, onboards a teammate, or before any first deploy of a project. Runs fully offline — no API keys, no network, no credentials.

Starr-del adabf21 2 files · 12.6 KB Updated Sep 17, 2026

File contents

env-drift

Part of shipsafe — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.

python3 scripts/env_drift.py <project_root> [--json]

Reports four classes:

MISSING — read in code, documented nowhere; a fresh deploy WILL fail on these. Highest priority.
UNDOCUMENTED — in local .env but not .env.example; the deploy platform and teammates can't reproduce the environment.
UNUSED — declared but never read; dead config or a typo'd name (a typo shows up as one UNUSED + one MISSING pair — point this out when you see it).
CLIENT_LEAK — secret-named vars with NEXT_PUBLIC_/VITE_/etc. prefixes. These are bundled into public JavaScript. Treat as critical; the secret must be rotated and moved server-side.
HARDCODED_URL — http://localhost:* baked into code (test files exempt). Works in dev, dead in production; the fix is an env var or relative path.
SERVER_ENV_IN_CLIENT — non-public process.env.X read inside a 'use client' component. In the browser it's undefined (silent breakage), and renaming it to NEXT_PUBLIC_* is only acceptable when it is genuinely not a secret.

Detects references in JS/TS (process.env, import.meta.env), Python (os.environ, os.getenv), and Deno. Runtime-provided vars (NODE_ENV, VERCEL_URL...) are excluded automatically.

After running: fix MISSING by adding the vars to the platform dashboard AND .env.example, and remind the user that platform env changes require a redeploy to take effect.

Exit codes: 0 clean, 1 findings.

All paths below are relative to this skill's directory (env-drift/).

---name: env-driftdescription: Find environment-variable drift between code, .env files, .env.example, and platform config (vercel.json / netlify.toml). Use whenever a deploy fails with undefined env vars, the user mentions 'missing environment variable', 'works locally but env is undefined in prod', sets up a new deploy environment, onboards a teammate, or before any first deploy of a project. Runs fully offline — no API keys, no network, no credentials.---# env-driftPart of **shipsafe** — offline deploy-safety skills. Every script is stdlib-only Python 3.8+; nothing leaves the machine.```bashpython3 scripts/env_drift.py <project_root> [--json]```Reports four classes:- **MISSING** — read in code, documented nowhere; a fresh deploy WILL fail on these. Highest priority.- **UNDOCUMENTED** — in local .env but not .env.example; the deploy platform and teammates can't reproduce the environment.- **UNUSED** — declared but never read; dead config or a typo'd name (a typo shows up as one UNUSED + one MISSING pair — point this out when you see it).- **CLIENT_LEAK** — secret-named vars with NEXT_PUBLIC_/VITE_/etc. prefixes. These are bundled into public JavaScript. Treat as critical; the secret must be rotated and moved server-side.- **HARDCODED_URL** — `http://localhost:*` baked into code (test files exempt). Works in dev, dead in production; the fix is an env var or relative path.- **SERVER_ENV_IN_CLIENT** — non-public `process.env.X` read inside a `'use client'` component. In the browser it's `undefined` (silent breakage), and renaming it to NEXT_PUBLIC_* is only acceptable when it is genuinely not a secret.Detects references in JS/TS (process.env, import.meta.env), Python (os.environ, os.getenv), and Deno. Runtime-provided vars (NODE_ENV, VERCEL_URL...) are excluded automatically.After running: fix MISSING by adding the vars to the platform dashboard AND .env.example, and remind the user that platform env changes require a redeploy to take effect.Exit codes: 0 clean, 1 findings.All paths below are relative to this skill's directory (env-drift/).

Frequently asked questions