Skills Guide

Environment Variable Handler

VerifiedSafe

Manage environment variables securely. Handles distinction between .env template and .env.local secrets.

Download and use
Sby Skills Guide Bot
SecurityBeginner
8/3/2026
Claude CodeCursorWindsurfCodex
#env-vars#secrets-management#dotenv#configuration#nextjs

Recommended for

Claude CodeCursorFullstack developerWindsurfCodexSecurity audit

Automated summary

Enforces environment variable handling by separating the `.env` template file from secrets kept in `.env.local`.

Strengths

  • Sets a clear, explicit convention: `.env` as the template, `.env.local` for git-ignored secrets
  • Requires sensitive values to never be written in plaintext inside `.env`
  • Provides a step-by-step procedure for adding a secret, including explicitly asking the user to fill it in
  • Ships a short checklist to verify before committing

Limitations

  • Assumes a Node/Next.js project and ignores other secret stores (Vault, CI variables, cloud managers)
  • Relies on an author-specific convention that contradicts the widespread `.env.example` practice
  • Does not automatically confirm that `.env.local` is listed in `.gitignore`
When to use it

Use it when an agent needs to add, change, or document environment variables in a Node/Next.js project.

When not to use it

Avoid it on projects that follow a different configuration scheme or rely on a centralized secrets manager.

Security analysis

Safe
Quality score82/100

The skill only provides instructions for managing environment variable files and explicitly avoids handling or exposing real secret values. It does not instruct execution of commands, network access, file deletion, or any dangerous operations. No declared tools are used.

No concerns found

How this analysis is made

Examples

Add an API token
I need to integrate Replicate. Add the REPLICATE_API_TOKEN variable to the project's environment configuration following our convention.
Add a public config var
Add a NEXT_PUBLIC_APP_URL variable set to http://localhost:3000 for local development.
Audit env files
Review my .env and .env.local files and check that every secret has an empty placeholder in .env and a real value in .env.local.

name: env-handler description: Manage environment variables securely. Handles distinction between .env (template) and .env.local (secrets).

Environment Variable Handler

Core Rules

  1. NO .env.example: Do not create this file. Use .env as the template.
  2. Secrets in .env.local: Actual sensitive values must live in .env.local (git-ignored).
  3. Placeholders: Every variable in .env.local MUST have a corresponding entry in .env.
    • If sensitive: KEY=""
    • If public/common: KEY="default_value"

Instructions

1. Adding a New Sensitive Variable

When you need to add a secret (e.g., REPLICATE_API_TOKEN):

  1. Update .env: Add the variable with an empty string value.

    # .env
REPLICATE_API_TOKEN=""

  2. Ask the User: Explicitly request the user to add the actual value to their local secrets file.

    "I have added REPLICATE_API_TOKEN to your .env file. Please open .env.local and add the actual token: REPLICATE_API_TOKEN=your_token_here"

2. Adding a Non-Sensitive Variable

When adding a public or configuration variable (e.g., NEXT_PUBLIC_APP_URL):

  1. Update .env: Add the variable with its default or development value. 
    # .env
NEXT_PUBLIC_APP_URL="http://localhost:3000"

3. Reading Variables

  • Server-side: process.env.KEY
  • Client-side: process.env.NEXT_PUBLIC_KEY

Checklist

  • [ ] Is the variable in .env?
  • [ ] If sensitive, is the value in .env empty?
  • [ ] Did I ask the user to update .env.local?

From the file to a first result

The download contains exactly the content displayed on this page. This copy may differ from the latest version in the source repository.

View the source and supporting files

This download contains SKILL.md only. Any scripts, references, templates and dependencies are not included. Get the required files from the source, preserving their directory structure, before continuing.

1. Download the file

Download SKILL.md

From the root of a test project, save the file as .skill-downloads/environment-variable-handler-mscrezog/SKILL.md, or use the command below. This folder is for inspecting the skill before installation.

Command for macOS/Linux or WSL: requires a POSIX shell and curl. On Windows without WSL, use the download button and create the folder manually.

mkdir -p '.skill-downloads/environment-variable-handler-mscrezog' && curl --fail --show-error --location 'https://skills-guides.com/api/skills/environment-variable-handler-mscrezog/download' --output '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md.part' && mv '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md.part' '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md'

2. Check prerequisites

Read SKILL.md before using it. If it references scripts or external services, inspect them and prepare the required access in your test environment.

No recognized prerequisites section in this file. This does not mean it is self-contained: libraries, tools and access requirements may be mentioned elsewhere in the content or source repository.

The platforms on this page are catalog indications. The paths below follow tool documentation; they do not prove this skill has been run in those tools. No minimum tool version is confirmed for this listing.

3. Load the skill

After inspection, copy the complete folder into your project using one of the commands below, then open a new tool session. The command stops if a folder with the same name already exists: compare the files before replacing it.

Claude Code
test -f '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md' && test -s '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md' && mkdir -p '.claude/skills' && test ! -e '.claude/skills/env-handler' && cp -R '.skill-downloads/environment-variable-handler-mscrezog' '.claude/skills/env-handler'

Cursor
test -f '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md' && test -s '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md' && mkdir -p '.cursor/skills' && test ! -e '.cursor/skills/env-handler' && cp -R '.skill-downloads/environment-variable-handler-mscrezog' '.cursor/skills/env-handler'

Codex
test -f '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md' && test -s '.skill-downloads/environment-variable-handler-mscrezog/SKILL.md' && mkdir -p '.agents/skills' && test ! -e '.agents/skills/env-handler' && cp -R '.skill-downloads/environment-variable-handler-mscrezog' '.agents/skills/env-handler'

OpenSkills

OpenSkills must already be installed. The local install/read procedure is checked with OpenSkills 1.5.0, which requires Node.js ≥ 20.6.0. Catalog slugs are not resolved automatically.

Official OpenSkills installation
openskills install './.skill-downloads/environment-variable-handler-mscrezog'

openskills read 'environment-variable-handler-mscrezog'

Reading should display the installed file content and its base directory. It does not run the skill or install its dependencies.

For an agent that reads AGENTS.md, then sync the index. This command changes AGENTS.md: review the diff before using it.

openskills sync

Manual method or another tool: attach SKILL.md to a conversation, or open it in an agent that can read files. Include any required supporting resources. No universal folder is recognized by every tool.

4. Try a first task

Use a short, synthetic input: an API endpoint, a small document or an interface brief. In a new conversation, attach the file or give the agent its path, then adapt this request:

Read .skill-downloads/environment-variable-handler-mscrezog/SKILL.md and apply its instructions to this example: [describe a test input]. Identify any missing files, dependencies or access. Produce the result requested by the skill without inventing data or running unreviewed scripts.

Expected result: output matching the skill instructions, or a precise list of missing prerequisites. A read confirmation alone does not validate a first use. If an external resource is unavailable, that path remains untested.

Related skills

DeFi AMM Security

Security

Security checklist for Solidity AMM contracts, liquidity pools, and swap flows. Covers reentrancy, donation attacks, oracle manipulation, slippage, and integer math.

Claude CodeCursorCodexadvancedSafe 243,989
Skills Guide Bot

Semgrep Rule Creator

Security

Creates custom Semgrep rules for detecting security vulnerabilities, bug patterns, and code patterns. Includes test-first methodology, taint mode support, and validation steps. Helps when building targeted static analysis detections.

Claude CodeintermediateSafe 21,468
Skills Guide Bot

Dev Toolbar Review Guide

Security

Safety rules for the dev toolbar, PostHog client, and feature flags. Use when reviewing changes to dev-tools and related files, covering environment guards, override cookies, and SSE stream safety.

Claude CodeCursorCodexintermediateSafe 108,624
Skills Guide Bot