Agent skill · security · alirezarezvani
env-secrets-manager
Use when auditing .env files, planning credential rotation, chasing a missing env var in production or hardening a repo against leaked secrets. Scans for committed secrets and drift with env_auditor.py.
Why this skill is useful
Adds specific scripts for auditing and managing environment variables that the AI wouldn't reliably generate on its own.
What it needs
Requires python3 installed locally. About 6k tokens when loaded. Last updated 2026-08-05. 23,939 stars on the source repository.
What this skill does
Env & Secrets Manager Tier: POWERFUL Category: Engineering Domain: Security / DevOps / Configuration Management --- Overview Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness. Core Capabilities .env and .env.example lifecycle guidance Secret leak detection for repository working trees Severity-based findings for likely credentials Operational pointers for rotation and containment Integration-ready outputs for CI checks --- When to Use Before pushing commits that touched env/config files During security audits and incident triage When onboarding contributors who need safe env conventions When validating that no obvious secrets are hardcoded --- Quick Start --- Recommended Workflow 1. Run scripts/envauditor.py on the repository root. 2. Prioritize critical and high findings first. 3. Rotate real credentials and remove exposed values. 4. Update .env.example and .gitignore as needed. 5. Add or tighten pre-commit/CI secret scanning gates. --- Reference Docs references/validation-detection-rotation.md references/secret-patterns.md --- Common Pitfalls Committing real values in .env.example Rotating one system but missing downstream consumers Logging secrets during debugging or incident response Treating suspected leaks as low urgency without validation Best Practices 1. Use a secret manager as the production source of truth. 2. Keep dev env files local and gitignored. 3. Enforce detection in CI before merge. 4. Re-test application paths immediately after credential rotation. --- Cloud Secret Store Integration Production applications should never read secrets from .env files or environment variables baked into container images. Use a dedicated secret store instead. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills alirezarezvani/env-secrets-manager--53dd27