agentleFS
Sign inStart free
binay-pybinay-py/claude-skills/skills/env-doctor/SKILL.md

env-doctor

Skill1 starsChanged 6 days agoMITView on GitHub

Check a project's environment variables against its code — variables the code reads that .env.example doesn't document, stale keys nothing reads, keys unset in .env/.env.local (undefined at runtime), secrets exposed to the browser through VITE_/NEXT_PUBLIC_/REACT_APP_-style prefixes, real-looking keys inside .env.example, and .env files committed to git or missing from .gitignore. Never prints values. Use for "works on my machine" bugs, onboarding a repo, before open-sourcing or deploying, or when a variable is undefined.

  • Reads credentials

9 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

1 rule. 0 are common, 0 are distinctive, and 1 is very specific to this project.

  • 0

    Common

    Most of the 7 edited versions we read keep these.

  • 0

    Distinctive

    This author's own choices. Worth a look.

  • 1

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Very specific:

    After --fix-example, give each new key a placeholder and a one-line comment saying where to get it.

    line 29

“Common” is measured: kept by at least 6 in 10 of the 7 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

env-doctor

scripts/env-doctor.mjs is zero-dependency Node 22+ and read-only unless --fix-example.

node env-doctor.mjs [project-dir]
node env-doctor.mjs . --fix-example     # append missing keys (empty) to .env.example, backup kept

It finds variable reads in JS/TS (process.env.X, process.env["X"], destructuring, import.meta.env.X, Deno.env.get, Bun.env), Python (os.environ[...], .get, os.getenv), Ruby, Go, PHP, Rust, and ${X} in shell scripts, Dockerfiles and docker-compose. In Cloudflare Workers projects (a wrangler.toml/json/jsonc or .dev.vars) it also reads env.X and treats .dev.vars as the local env file, ignoring names the wrangler config declares as bindings or [vars]. It skips node_modules, build output and virtualenvs, and ignores standard runtime variables (NODE_ENV, PORT, HOME, CI…).

SeverityFinding
higha secret-named variable with a browser-exposed prefix (VITE_SUPABASE_SERVICE_ROLE_KEY, NEXT_PUBLIC_STRIPE_SECRET): it ships in the JS bundle. Publishable/anon/site keys are allowed
higha real-looking key or credentialed URL in .env.example (localhost/user:pass placeholders are fine)
high.env / .env.local committed to git, or present in git history
mediumvariables used in code but missing from .env.example, or no example file at all
mediumvariables used in code but not set in any local env file; an env file not in .gitignore
lowexample keys no code reads (or that only a framework config reads); keys set but empty

Acting on it

  • Browser-exposed secret: move the call server-side (API route, edge function), drop the public prefix, and rotate the key, because it's already in every shipped bundle.
  • Committed .env: git rm --cached .env, add it to .gitignore, rotate everything in it. History keeps the old values.
  • After --fix-example, give each new key a placeholder and a one-line comment saying where to get it.

Limits

Static scan: dynamic names (process.env[name]) and variables read only by tools or framework config files (e.g. DATABASE_URL read by Prisma's schema) aren't seen, which is why "stale" is only low severity. Hosted env (Vercel/Cloudflare dashboards) isn't checked.

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

No reviews yet

People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.

  • It worked
  • Partly
  • It didn't
What did you use it for? e.g. Reviewing pull requests in a Rails app

Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.

Check your setup, free