env-hygiene
Skill0 starsChanged 5 months agoMITView on GitHub
Keep secrets and config clean: .env handling, .gitignore coverage, never committing secrets, and 12-factor config. Trigger when the user says "check my .env setup", "am I leaking config", "set up environment variables", or when adding config, a new env var, or onboarding a repo.
- Reads credentials
1 other project uses a version of this.
Adopted by
Most recently taken up by
- lukasrepublic/agentic-foundrytheir own version, first seen Oct 11, 2026
Other versions1 project uses a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 1
- lukasrepublic/agentic-foundry★ 1same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository8 other files it gives its agents.
- ci-security-gateSkill
- dependency-auditSkill
- dockerfile-hardeningSkill
- sbom-generationSkill
- secret-rotationSkill
- secscanSkill
- secure-code-reviewSkill
- threat-modelSkill
The file
We split this skill into the rules it gives an agent
5 rules. About 0 are common, 0 are distinctive, and 5 are very specific to this project.
≈0
Common · estimate
Many files like this have a rule of this kind.
≈0
Distinctive · estimate
This author's own choices. Worth a look.
5
Very specific
Tied to their project's names, files or tools. Probably skip.
- Common
- Distinctive
- Very specific
- could be automatic: a setting could enforce it
- Very specific: line 21
Check git history for already-committed secrets (git log -p, or run gitleaks detect).
- Very specific: line 22
Verify a non-secret .env.example exists so contributors know what to set.
- Very specific: line 40
Add the missing .gitignore entries, then git rm --cached <file> any secret already tracked (and rotate it if it was ever pushed).
- Very specific: line 41
Create/commit .env.example with every key documented and no real values.
- Very specific: line 43
Add a pre-commit secret scanner (gitleaks, secscan) and enable push protection so a secret can't get committed again.
≈ “Common” is an estimate: at least 1 in 5 of the 350,495 skill files we read have a rule of the same kind, not the same words. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.
Files
When to use
- Setting up or reviewing how a project handles configuration and secrets.
- Adding a new environment variable or config value.
- Onboarding/auditing a repo for "is anything secret about to be committed?"
- Separating dev/staging/prod configuration.
Process
- Inventory config sources:
.env,.env.*, config files, CI variables, and anything hardcoded in source. - Confirm
.gitignoreactually covers every secret-bearing file (checklist below). - Check git history for already-committed secrets (
git log -p, or rungitleaks detect). If any are found, treat as a leak → use thesecret-rotationskill (rotate first). - Verify a non-secret
.env.exampleexists so contributors know what to set. - Confirm dev and prod config are separated and prod secrets come from a manager, not a file in the repo.
- Fix gaps and document the config contract.
Checklist
.gitignoreincludes.env,.env.*,*.local,secrets/,*.pem,*.key,*.pfx, credential JSONs..env.exampleIS committed (keys only, dummy/empty values) — and the real.envis NOT.- No secrets hardcoded in source, configs, CI YAML, or client-side bundles (anything shipped to the browser is public).
- Secrets read from
process.env/os.environ— never inlined. - Git history is clean of credentials (scanned, not assumed).
- Prod secrets live in a secrets manager (Vault, AWS/GCP Secrets Manager, Doppler) or the CI/host's encrypted secret store — not in a
.envchecked into the repo. - Dev/staging/prod use separate credentials; a leaked dev key can't touch prod.
.envfiles are not baked into Docker images or build artifacts (seedockerfile-hardening).
How to fix — 12-factor config
- Store config in the environment, not in code. One codebase, many deploys, config injected per environment.
- Add the missing
.gitignoreentries, thengit rm --cached <file>any secret already tracked (and rotate it if it was ever pushed). - Create/commit
.env.examplewith every key documented and no real values. - Move production secrets to a manager and inject at deploy/runtime; give each environment its own credentials with least privilege.
- Add a pre-commit secret scanner (
gitleaks,secscan) and enable push protection so a secret can't get committed again. - Provide a one-line setup note:
cp .env.example .envthen fill values locally.
Report back
Summarize: what config sources exist, whether .gitignore fully covers secrets, whether .env.example is present, and the result of the history scan. List exactly what you fixed and any secret found in history (flag loudly — that needs rotation, not just deletion). End with a "config hygiene: clean / N gaps" verdict.
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.