Skills env-config
📦
env-config
Content revision r3 Critical 🌐 Network access🔑 Env variables📁 Filesystem access⚙️ External commands
Secure Python Environment Configuration
Python teams can leak credentials or mix settings across environments. This skill provides local tools and guidance for structured configuration and secrets handling.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "env-config" from https://skillstore.io/skills/autumnsgrove-env-config.md and its manifest at https://skillstore.io/api/skills/autumnsgrove-env-config/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "env-config". Plan environment configuration for a new Python API with a database and one external provider.
Expected outcome:
- Create separate templates and local secret files.
- Validate the database URL and provider key during startup.
- Keep production values outside source control and inject them at runtime.
Using "env-config". Compare development and production configuration without revealing credentials.
Expected outcome:
The comparison lists missing and changed variable names. Sensitive values are omitted, and permission issues are reported separately.
Using "env-config". Review a container deployment that uses an environment file.
Expected outcome:
The review recommends runtime secret injection, excludes environment files from image layers, and verifies owner-only access on local secret files.
Security Audit
Criticalv13 • 7/23/2026 Open versioned report
Most static matches reflect the skill's legitimate purpose: local environment configuration, placeholder credentials, documentation, and test fixtures. Confirmed risks include remote scripts piped to shells, plaintext secret disclosure, unsafe permissions, and insecure secret output. No prompt injection or exfiltration intent was found, but 281 lower-priority analyzer matches remain outside this adjudication. Static review was capped at 400/681 representative findings; omitted static matches are unconfirmed, so automatic publishing stays disabled until manual review.
10
Files scanned
3,518
Lines analyzed
5
Review items
0
False positives ignored
Confirmed security concerns (13)
Critical
Pipe to shell pattern
curl -LsSf https://astral.sh/uv/install.sh | sh
This command executes remotely downloaded installer content without prior inspection or integrity verification, so upstream or network compromise can execute arbitrary code.
Critical
Pipe to shell pattern
run: curl -LsSf https://astral.sh/uv/install.sh | sh
The CI example pipes an unpinned remote installer directly into a shell, allowing changed or compromised content to execute in the build environment.
Critical
Pipe to shell pattern
curl -LsSf https://astral.sh/uv/install.sh | sh
The troubleshooting command executes a remote installer without checksum or signature verification, creating a direct remote-code execution supply-chain risk.
Critical
Pipe to shell pattern
curl -LsSf https://astral.sh/uv/install.sh | sh
The primary instructions execute remote installer content directly in a shell without pinning or verification, exposing users to arbitrary code execution.
Critical
Pipe to shell pattern
- [ ] Install UV: `curl -LsSf https://astral.sh/uv/install.sh | sh`
The checklist repeats direct execution of an unverified remote installer, preserving the same supply-chain code-execution risk.
High
Environment file access
backup = Path('.env.backup')
The rotation example copies the complete plaintext environment file into .env.backup without restrictive permissions, duplicating all contained secrets.
High
Environment variant files
COPY .env.development /app/.env
The Dockerfile copies an environment file into an image layer, where embedded credentials can remain recoverable from the image history.
High
System reconnaissance
print(f"⚠ Skipping invalid line {line_num}: {line}")
The parser prints every malformed environment line verbatim, which can disclose a secret when a sensitive assignment lacks the expected separator.
Show all 13 confirmed findings
High
World-Readable Environment File Guidance
The troubleshooting guide recommends mode 644 for .env, allowing every local user to read credentials stored in that file.
The command explicitly applies read permission for group and other users to a file the skill describes as containing secrets.
High
Helper Prints Secret Values
Security checks, comparisons, and decryption can print plaintext values or large value prefixes to terminal output.
The code directly interpolates environment values into messages and prints the complete decrypted secrets object when no output path is supplied.
High
Debugging Guidance Exposes Configuration Values
The troubleshooting guide recommends displaying the full .env file and printing matching environment values, which may expose credentials.
Both examples directly render configuration values without redaction, despite the same guide treating environment files as sensitive.
High
Password Accepted Through Command-Line Arguments
Encryption and decryption accept a password option that can expose the password through shell history and process inspection.
Argparse stores the provided password from the process command line; secure getpass input is used only when that option is omitted.
Medium
Template Masking Can Preserve Sensitive Values
Template generation retains values unless their names match a short keyword list, so unconventional secret names can enter shareable templates.
The masking branch changes only recognized key names and URL fields; all other source values are written unchanged to the template.
Capability review items (5)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Database connection strings
print(f"Database: {config.database_url}")
The example prints the full database URL during debug mode, which can expose embedded usernames and passwords in logs or terminal history.
High
Database connection strings
print(settings.database_url)
The usage example prints the complete database URL, potentially disclosing credentials to logs, consoles, and captured build output.
High
Generic API/secret keys
>>> print(secrets.get('api_key'))
The documented decryption example prints an API key value, encouraging direct disclosure of decrypted credentials in terminal or notebook output.
High
Generic API/secret keys
SECRET_KEY=super-secure-random-key
The production configuration example supplies a fixed, guessable SECRET_KEY value that users may retain as an insecure credential.
High
Python file write/append
with open(args.output, 'w') as f:
The decrypt command writes plaintext secrets using default process permissions, so a permissive umask can create a file readable by other users.
Risk Factors
🌐 Network access (35)
examples/.env.example:50 examples/.env.example:86 examples/.env.example:190 examples/.env.example:60 examples/.env.example:61 examples/.env.example:62 examples/.env.example:63 examples/.env.example:64 examples/.env.example:65 examples/pyproject.toml:53 examples/pyproject.toml:54 examples/pyproject.toml:55 examples/pyproject.toml:56 examples/secrets_template.json:60 examples/secrets_template.json:94 examples/secrets_template.json:95 examples/secrets_template.json:29 examples/secrets_template.json:30 examples/secrets_template.json:31 examples/secrets_template.json:32 README.md:20 references/testing-guide.md:421 references/troubleshooting.md:144 references/troubleshooting.md:150 references/troubleshooting.md:153 references/troubleshooting.md:154 references/troubleshooting.md:257 references/troubleshooting.md:153 references/troubleshooting.md:154 SKILL.md:58 SKILL.md:454 SKILL.md:504 SKILL.md:505 SKILL.md:506 SKILL.md:507
🔑 Env variables (50)
examples/.env.example:94 examples/.env.example:95 examples/.env.example:100 examples/.env.example:25 examples/.env.example:33 examples/.env.example:170 examples/.env.example:41 examples/.env.example:45 examples/.env.example:49 examples/.env.example:54 examples/.env.example:76 examples/.env.example:118 examples/.env.example:157 examples/.env.example:196 examples/pyproject.toml:24 examples/pyproject.toml:101 examples/secrets_template.json:6 examples/secrets_template.json:7 examples/secrets_template.json:8 examples/secrets_template.json:9 examples/secrets_template.json:11 examples/secrets_template.json:37 examples/secrets_template.json:62 examples/secrets_template.json:68 README.md:115 README.md:116 README.md:117 README.md:118 README.md:115 README.md:116 README.md:117 README.md:118 README.md:38 README.md:106 README.md:110 README.md:224 README.md:106 README.md:110 README.md:80 README.md:117 README.md:118 README.md:131 README.md:132 references/advanced-topics.md:98 references/advanced-topics.md:103 references/advanced-topics.md:106 references/advanced-topics.md:161 references/advanced-topics.md:163 references/advanced-topics.md:207 references/advanced-topics.md:103
📁 Filesystem access (9)
⚙️ External commands (50)
references/troubleshooting.md:395 SKILL.md:56-65 SKILL.md:65-69 SKILL.md:69-83 SKILL.md:83-91 SKILL.md:91-97 SKILL.md:97-101 SKILL.md:101-106 SKILL.md:106-111 SKILL.md:111-112 SKILL.md:112-113 SKILL.md:113-114 SKILL.md:114-115 SKILL.md:115-119 SKILL.md:119-135 SKILL.md:135-141 SKILL.md:141-167 SKILL.md:167-171 SKILL.md:171 SKILL.md:173-213 SKILL.md:213-215 SKILL.md:215-219 SKILL.md:219-228 SKILL.md:228-234 SKILL.md:234-235 SKILL.md:235-240 SKILL.md:240-242 SKILL.md:242-243 SKILL.md:243-249 SKILL.md:249-253 SKILL.md:253-260 SKILL.md:260-266 SKILL.md:266-267 SKILL.md:267-274 SKILL.md:274-278 SKILL.md:278-280 SKILL.md:280-292 SKILL.md:292-297 SKILL.md:297-298 SKILL.md:298-304 SKILL.md:304-325 SKILL.md:325-327 SKILL.md:327-333 SKILL.md:333-334 SKILL.md:334-341 SKILL.md:341-346 SKILL.md:346-350 SKILL.md:350-355 SKILL.md:355-359 SKILL.md:359-361
Detected Patterns
Pipe to shell pattern×5System reconnaissance
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/autumnsgrove-env-config/audits/13?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/autumnsgrove-env-config?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/autumnsgrove-env-config?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/autumnsgrove-env-config/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/autumnsgrove-env-config.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
AutumnsGrove. (2026). env-config security audit report (audit version 13) [Author version unspecified]. Skillstore. https://skillstore.io/skills/autumnsgrove-env-config/audits/13BibTeX citation
@techreport{autumnsgrove-autumnsgrove-env-config-2026,
author = {AutumnsGrove},
title = {env-config security audit report (audit version 13)},
institution = {Skillstore},
year = {2026},
number = {13},
url = {https://skillstore.io/skills/autumnsgrove-env-config/audits/13},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "env-config security audit report (audit version 13)"
version: "unspecified"
type: report
authors:
- name: "AutumnsGrove"
date-released: "2026-07-23"
url: "https://skillstore.io/skills/autumnsgrove-env-config/audits/13"
identifiers:
- type: other
value: "skillstore:autumnsgrove-env-config:audit:13"
description: "Skillstore immutable audit report identifier"
Compare variants
2 installable variantsEach author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.
Why this variant is first
Higher Skillstore usage
Author / source Skillstore Score Evidence Confidence Skillstore usage Updated
autumnsgrove-env-config
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 23
Updated
2026-08-21
awais68-env-config
Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 12
Updated
2026-08-21
Skillstore Score
Why this score Evidence Confidence: Medium 82
Architecture
85
Maintainability
87
Content
70
Community
78
Spec Compliance
What You Can Build
Set Up a Python Project
Create a consistent local configuration structure, dependency setup, template, and validation workflow.
Separate Deployment Environments
Plan distinct development, staging, and production settings with runtime injection for containers.
Review Configuration Security
Identify missing variables, placeholder secrets, unsafe storage, and configuration practices that need correction.
Try These Prompts
Create a Basic Setup
Set up environment configuration for my Python UV project. List required files, dependencies, variables, and validation steps.
Add Configuration Validation
Review my required variable list and design startup validation for development and production. Do not print secret values.
Design Multiple Environments
Design development, staging, and production configuration for this service. Explain precedence, container injection, testing, and secret isolation.
Audit and Migrate Configuration
Audit this configuration workflow for credential exposure, unsafe permissions, logging, backups, and rotation. Provide a prioritized migration plan.
Best Practices
- Keep real secret files outside version control and container images.
- Validate required names at startup without printing their values.
- Use owner-only permissions and rotate credentials after suspected exposure.
Avoid
- Do not pipe remote installers directly into a shell.
- Do not print database URLs, API keys, or decrypted secret objects.
- Do not copy environment files into images or broadly readable backups.
Frequently Asked Questions
Does this skill create environment files automatically?
It provides a helper for templates and merges. Review output paths and permissions before using generated files.
Can it store secrets in AWS, Google Cloud, or Azure?
It documents integration patterns, but the helper does not provision or manage cloud secret stores.
Does it support development, staging, and production?
Yes. The guidance covers environment-specific files, precedence, testing, and runtime container injection.
How are local secrets encrypted?
The helper uses Fernet with a key derived from a password through PBKDF2.
Is the bundled helper safe for production without changes?
No. Remove sensitive output, enforce owner-only permissions, and address the audit remediation before production use.
Which AI tools can use this skill?
The metadata declares support for Claude, Codex, and Claude Code.
Developer Details
Author
AutumnsGroveLicense
MIT
Skillstore revision
r3
Version notice
The author did not declare a version.
Ref
89edfdc710d0846129dcee6a929477b04f08052c
Maintenance freshness
7/24/2026
Usage
20 downloads · 191 views
File structure