Env Secrets Manager
Manage environment-variable hygiene and secrets safety across local development and production.
by AgentVoltv1.0.0Published 1y ago1 install
Free to sign up · every skill included with AgentVolt Pro
Before & after
Same prompt, same agent — the only difference is the skill.
Prompt“Audit my .env files for secrets leakage”
Beforegeneric AI agent
I can help you audit your environment files for security issues. There are a few things to check — whether any secrets have been committed to git, whether your .env files are properly ignored, whether you're using secrets management tools in production, and whether your team has access controls. I'd want to look at your repository structure and your current process. Generally, secrets should never be in version control, and you should use a secrets manager like Vault or a service-provided option instead. Do you have a .gitignore set up to exclude your .env files?
Afterwith Env Secrets Manager
ENVIRONMENT VARIABLE SECURITY AUDIT REPO SCAN: Secrets found in git history • .env (committed Dec 2024) — Contains: DATABASE_PASSWORD, STRIPE_SECRET_KEY, JWT_SECRET Risk: HIGH — Anyone with repo access has production credentials Action: Rotate all 3 secrets immediately. Use git-filter-branch to remove from history. • config/database.yml (committed Mar 2024) — Contains: db_password in plaintext Risk: CRITICAL — Database password exposed for 150 days Action: Reset database user password now. Audit database access logs for unauthorized activity. • .env.production (NOT committed, good) — Current state: 47 vars, all safe LOCAL DEVELOPMENT DRIFT .env.local (your machine) vs .env.example (team template): • You have: SENTRY_DSN, NEW_FEATURE_FLAG (extras) • Team doesn't have: SENTRY_DSN • Risk: MEDIUM — Env drift means new team members miss required secrets Action: Sync .env.example with all required vars (including Sentry) PRODUCTION SECRETS LEAKAGE Env vars not protected: • DATABASE_PASSWORD: stored in Vercel env (GOOD) • STRIPE_SECRET_KEY: stored in Vercel env (GOOD) • API_BASE_URL: hardcoded in code (BAD if it contains credentials) Risk: LOW (URL only, no secrets embedded) Third-party secret exposure: • GitHub Actions: .env.production hardcoded in deploy step (BAD) Risk: CRITICAL — GitHub Actions logs are world-readable if workflow fails Action: Use GitHub Secrets instead. Change all secrets from this workflow immediately. ROTATION READINESS Secrets last rotated: Never documented Action: Create rotation schedule: quarterly for API keys, immediately for leaked keys Secrets by type: • Database password: rotatable (1h downtime) • Stripe API key: rotatable (5 min, no downtime) • JWT secret: rotatable (5 min, sessions expire 24h, safe to swap) ACCESS CONTROL Team members with access to Vercel env: • drew@omnispark.co (GOOD) • 3 team members (need review) Action: Audit Vercel team permissions. Document who needs what secret. RECOMMENDATIONS (Priority order) 1. IMMEDIATE (today): Rotate DATABASE_PASSWORD, STRIPE_SECRET_KEY, JWT_SECRET — they were in git 2. TODAY: Update GitHub Actions workflow to use GitHub Secrets instead of .env file 3. THIS WEEK: Run git-filter-branch to scrub old commits, then force-push to main 4. THIS WEEK: Add git hook to prevent secrets commit: install pre-commit framework + detect-secrets plugin 5. ONGOING: Quarterly rotation schedule for all API keys. Document in README. RESOURCES NEEDED • git-filter-branch (comes with git) • detect-secrets Python package (for pre-commit hook) • Time: 90 min to fix + verify • Alertness: Monitor database/Stripe logs for suspicious activity next 72h
About this skill
name: env-secrets-manager description: Use when Manage environment-variable hygiene and secrets safety across local development and production.
Env Secrets Manager
Manage environment-variable hygiene and secrets safety across local development and production. Practical auditing, drift awareness, rotation readiness. Use when auditing .env files for committed secrets, planning a credential rotation, debugging missing-env-var production incidents, or hardening a new project against secrets leakage.
What you get
- Public GitHub repo (alirezarezvani/claude-skills)
- the env-secrets-manager skill folder with SKILL.md. Part of a 337-skill / 30-agent / 70-command install.
Customize your output
- Fork the repo and adapt the skill's instructions and references to your workflow.
Example output
Activates automatically when your request matches Env Secrets Manager; chains with the other skills, agents, and commands in the collection.
Best for
Creators, builders, and teams using Claude Code.
SKILL.md preview
SKILL.md
---
name: env-secrets-manager
description: Use when auditing .env files for committed secrets, planning a credential rotation, debugging a missing-environment-variable production incident, or hardening a project against secrets leakage.
version: 1.0.0
category: Development / Engineering
author: AgentVolt
license: proprietary
tags:
- development
- engineering
---
# Env Secrets Manager
Handles environment-variable hygiene and secrets safety across local and production: auditing, rotation, and drift detection.
## When to use
… (sign up to view the full skill)Sign up to view, copy, and install the full skill
More development skills
View all Development skills →Generate
Scaffold code, tests, and boilerplate from a short spec.
Development
Performance Profiler
Systematic performance profiling for Node.js, Python, and Go applications.
Development
Threat Detection
Use when hunting for threats in an environment, analyzing IOCs, or detecting behavioral anomalies in telemetry.
Development
Agent Harness
Turns a domain folder of skills into a bounded agentic loop: compile a goal into a task plan, execute with the domain's tools, verify every task, retry within a budget.
Development