neekware/artifacts/bundle/skills/engineering/env-secrets-manager
artifacts/bundle/skills/engineering/env-secrets-manager/SKILL.md
# Env & Secrets Manager **Tier:** POWERFUL **Category:** Engineering **Domain:** Security / DevOps / Configuration Management --- ## Overview Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness. ## Core Capabilities - `.env` and `.env.example` lifecycle guidance - Secret leak detection for repository working trees - Severity-based findings for likely crede
development
Updated Apr 24, 2026
$ install --global
skillsauthnpx skillsauth add neekware/ehayeskills artifacts/bundle/skills/engineering/env-secrets-managerInstall this skill globally with one command. Works with Claude Code, Cursor, and Windsurf.
Security Scan Results
3 of 9 scanners reported clean
Some scanners were skipped, did not run, or reported a non-clean status. Review each row below.
3
Scanners Passed
9
Scanners in report
Clean
TrivyContainer and dependency vulnerability scanner
95%
Clean
SemgrepStatic code analysis for vulnerabilities
95%
Clean
mcp-scan (Snyk)Model Context Protocol security validation
95%
Skipped
Snyk (dep)Open source security scanning
50%
Skipped
Socket.devSupply chain security analysis
50%
Skipped
VirusTotalMulti-engine malware detection
50%
Skipped
CrowdStrikeAdvanced threat intelligence
50%
Skipped
OSV-ScannerOpen Source Vulnerability database check
50%
Skipped
OWASP Dep-Check
50%
Last scanned: Apr 24, 2026, 4:04 PM260.1s1 file scanned
SKILL.md
Env & Secrets Manager
Tier: POWERFUL Category: Engineering Domain: Security / DevOps / Configuration Management
Overview
Manage environment-variable hygiene and secrets safety across local development and production workflows. This skill focuses on practical auditing, drift awareness, and rotation readiness.
Core Capabilities
.envand.env.examplelifecycle guidance- Secret leak detection for repository working trees
- Severity-based findings for likely credentials
- Operational pointers for rotation and containment
- Integration-ready outputs for CI checks
When to Use
- Before pushing commits that touched env/config files
- During security audits and incident triage
- When onboarding contributors who need safe env conventions
- When validating that no obvious secrets are hardcoded
Quick Start
# Scan a repository for likely secret leaks
python3 scripts/env_auditor.py /path/to/repo
# JSON output for CI pipelines
python3 scripts/env_auditor.py /path/to/repo --json
Recommended Workflow
- Run
scripts/env_auditor.pyon the repository root. - Prioritize
criticalandhighfindings first. - Rotate real credentials and remove exposed values.
- Update
.env.exampleand.gitignoreas needed. - Add or tighten pre-commit/CI secret scanning gates.
Reference Docs
references/validation-detection-rotation.mdreferences/secret-patterns.md
Common Pitfalls
- Committing real values in
.env.example - Rotating one system but missing downstream consumers
- Logging secrets during debugging or incident response
- Treating suspected leaks as low urgency without validation
Best Practices
- Use a secret manager as the production source of truth.
- Keep dev env files local and gitignored.
- Enforce detection in CI before merge.
- Re-test application paths immediately after credential rotation.
Creator: Engineering License: MIT Source Repo:
neekware/ehaye-skillsSource Bucket:engineeringOriginal Path:engineering/env-secrets-manager
Related Skills
neekware/stress-test
testing
VerifiedTrustedCommunity
/em -stress-test — Business Assumption Stress Testing
SKILL.mdUpdated Jul 1, 2026
neekware/postmortem
research
VerifiedTrustedCommunity
/em -postmortem — Honest Analysis of What Went Wrong
SKILL.mdUpdated Jul 1, 2026
neekware/hard-call
development
VerifiedTrustedCommunity
/em -hard-call — Framework for Decisions With No Good Options
SKILL.mdUpdated Jul 1, 2026
neekware/challenge
research
VerifiedTrustedCommunity
/em -challenge — Pre-Mortem Plan Analysis
SKILL.mdUpdated Jul 1, 2026