Env & Secrets Manager — Development

Q: How do I scan a repository for secrets?

Run `python3 scripts/env_auditor.py /path/to/repo` from the skill's directory.

Q: Can I use this in CI?

Yes, use the `--json` flag to get JSON output suitable for CI pipelines.

Env & Secrets Manager helps you audit environment-variable hygiene and secrets safety across local development and production. It provides practical auditing, drift awareness, and rotation readiness, including secret leak detection, severity-based findings, and integration-ready outputs for CI checks.

engineering claude-code

📂 View skill on GitHub ↗ 🚀 How to use

✨ What it does

Scans repositories for likely secret leaks with severity-based findings
Provides guidance on .env and .env.example lifecycle
Offers operational pointers for rotation and containment
Supports JSON output for CI pipelines
Includes reference docs on validation, detection, and rotation

🎯 When to use it

Before pushing commits that touched env/config files
During security audits and incident triage
When onboarding contributors who need safe env conventions
When validating that no obvious secrets are hardcoded

🚀 How to use

Trigger by asking to audit environment variables or secrets in a repository. Run the provided script: python3 scripts/env_auditor.py /path/to/repo (optionally with --json for CI). The skill expects a repository path and optionally a JSON flag. Example prompts:

Audit my repository for leaked secrets.
Scan /path/to/repo and output JSON for CI.

📄 Output: A report of secret leak findings with severity levels, plus recommendations for rotation and containment.

📦 Add this skill to Claude Code

# 1. Get the skills repo
git clone --depth 1 https://github.com/alirezarezvani/claude-skills /tmp/claude-skills

# 2. Copy this skill into your project (or ~/.claude/skills for all projects)
mkdir -p .claude/skills
cp -r /tmp/claude-skills/engineering/skills/env-secrets-manager .claude/skills/env-secrets-manager

Skill source: engineering/skills/env-secrets-manager/SKILL.md

⚠️ Good to know

Requires Python to run the auditor script; the skill itself does not automatically rotate secrets or enforce policies.

❓ FAQ

How do I scan a repository for secrets?

Run python3 scripts/env_auditor.py /path/to/repo from the skill's directory.

What should I do with critical findings?

Prioritize critical and high findings, rotate real credentials, remove exposed values, and update .env.example and .gitignore.

Can I use this in CI?

Yes, use the --json flag to get JSON output suitable for CI pipelines.

🤖 Overview, features, install steps and FAQ were generated from the project's SKILL.md on Sep 4, 2026. Always check the original source before running commands.