Skills env-config
📦

env-config

Content revision r1 High Risk ⚙️ External commands🌐 Network access📁 Filesystem access🔑 Env variables

Configure Environment Settings

Environment settings often spread across files and deployment targets. This skill provides typed FastAPI patterns for .env templates, validation, and secret handling.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "env-config" from https://skillstore.io/skills/awais68-env-config.md and its manifest at https://skillstore.io/api/skills/awais68-env-config/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/awais68-env-config.md Signed manifest GET /api/skills/awais68-env-config/manifest Signed lockfile GET /api/skills/awais68-env-config/lockfile

Test it

Using "env-config". Set up configuration for a new FastAPI project.

Expected outcome:

  • A settings plan with application, database, JWT, Redis, logging, and CORS sections.
  • A list of required and optional variables with validation notes.
  • Guidance on which values belong in local files versus deployment settings.

Using "env-config". Review whether our .env files are safe to commit.

Expected outcome:

  • A commit policy that allows templates and blocks local or production secret files.
  • A checklist for placeholder values, generated secrets, and ignored private files.
  • Warnings about copying weak sample secrets into deployed environments.

Using "env-config". Improve our secret rotation process.

Expected outcome:

  • A safer rotation workflow with backups, path limits, and validation before writing changes.
  • Advice to prefer managed secrets in production.
  • A reminder to redact secret values from logs and review output.

Security Audit

High Risk
v11 • 7/9/2026 Open versioned report

Most external command and network detections are false positives from markdown code fences, inline examples, and localhost CORS values. Real risk remains because the skill intentionally guides work with .env files, secret names, environment variants, and a file-writing rotation example. No prompt injection, credential exfiltration intent, or unauthorized network behavior was found.

2
Files scanned
430
Lines analyzed
7
Review items
0
False positives ignored

Confirmed security concerns (17)

High
SKILL.md:4
Environment file access
Use when setting up environment configuration, loading .env files, or managing
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:6
Environment file access
Triggers for: .env setup, loading environment variables, Pydantic BaseSettings,
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:19
Environment file access
| Load .env | `load_dotenv()` at application start |
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:29
Environment file access
├── .env # Local development (NOT committed)
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:31
Environment file access
├── .env.staging # Staging environment
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:32
Environment file access
├── .env.production # Production environment (managed by infra)
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:49
Environment file access
env_file=".env",
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:125
Environment file access
## .env - Local Development
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
Show all 17 confirmed findings
High
SKILL.md:128
Environment file access
# .env - Local development only
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:160
Environment file access
load_dotenv() # Load .env file
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:239
Environment file access
"development": ".env",
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:240
Environment file access
"staging": ".env.staging",
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:241
Environment file access
"production": ".env.production",
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:242
Environment file access
}.get(env, ".env")
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:280
Environment file access
"""Replace secret value in .env file."""
The skill explicitly guides loading, creating, or selecting .env files that can contain credentials. This is legitimate configuration work, but it is still sensitive-file access.
High
SKILL.md:32
Environment variant files
├── .env.production # Production environment (managed by infra)
The static finding references sensitive configuration behavior, and no stronger false-positive evidence was found. It is kept for review with low confidence.
High
SKILL.md:241
Environment variant files
"production": ".env.production",
The static finding references sensitive configuration behavior, and no stronger false-positive evidence was found. It is kept for review with low confidence.
Capability review items (7)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

Medium
SKILL.md:290
Python file write/append
with open(env_file, "w") as f:
The rotation example opens a caller-supplied env_file for writing. If copied without guards, it could overwrite or corrupt sensitive configuration files.
Low
SKILL.md:19
dotenv library
| Load .env | `load_dotenv()` at application start |
The skill instructs applications to load .env files with python-dotenv. This is legitimate, but .env files often contain secrets and require careful handling.
Low
SKILL.md:158
dotenv library
from dotenv import load_dotenv
The skill instructs applications to load .env files with python-dotenv. This is legitimate, but .env files often contain secrets and require careful handling.
Low
SKILL.md:160
dotenv library
load_dotenv() # Load .env file
The skill instructs applications to load .env files with python-dotenv. This is legitimate, but .env files often contain secrets and require careful handling.
Low
SKILL.md:19
Python dotenv loader
| Load .env | `load_dotenv()` at application start |
The skill instructs applications to load .env files with python-dotenv. This is legitimate, but .env files often contain secrets and require careful handling.
Low
SKILL.md:158
Python dotenv loader
from dotenv import load_dotenv
The skill instructs applications to load .env files with python-dotenv. This is legitimate, but .env files often contain secrets and require careful handling.
Low
SKILL.md:160
Python dotenv loader
load_dotenv() # Load .env file
The skill instructs applications to load .env files with python-dotenv. This is legitimate, but .env files often contain secrets and require careful handling.

Risk Factors

⚙️ External commands (38)
SKILL.md:19 SKILL.md:20 SKILL.md:21 SKILL.md:22 SKILL.md:23 SKILL.md:27-36 SKILL.md:36-40 SKILL.md:40-93 SKILL.md:93-98 SKILL.md:98-123 SKILL.md:123-127 SKILL.md:127-149 SKILL.md:149-155 SKILL.md:155-183 SKILL.md:183-187 SKILL.md:187-204 SKILL.md:204-208 SKILL.md:208-223 SKILL.md:223-229 SKILL.md:229-245 SKILL.md:245-249 SKILL.md:249-257 SKILL.md:257-263 SKILL.md:263-269 SKILL.md:269-273 SKILL.md:273-303 SKILL.md:303-307 SKILL.md:307-308 SKILL.md:308-311 SKILL.md:311-319 SKILL.md:319-320 SKILL.md:320-321 SKILL.md:321-322 SKILL.md:322-323 SKILL.md:323-329 SKILL.md:329-337 SKILL.md:337-345 SKILL.md:345-367
🌐 Network access (3)
SKILL.md:82 SKILL.md:122 SKILL.md:148
📁 Filesystem access (1)
SKILL.md:290
🔑 Env variables (16)
SKILL.md:19 SKILL.md:158 SKILL.md:160 SKILL.md:19 SKILL.md:158 SKILL.md:160 SKILL.md:76 SKILL.md:116 SKILL.md:144 SKILL.md:68 SKILL.md:111 SKILL.md:139 SKILL.md:215 SKILL.md:254 SKILL.md:265 SKILL.md:319
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/awais68-env-config/audits/11?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/awais68-env-config/security.svg)](https://skillstore.io/skills/awais68-env-config?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/awais68-env-config?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/awais68-env-config/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/awais68-env-config.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

Awais68. (2026). env-config security audit report (audit version 11) [Author version unspecified]. Skillstore. https://skillstore.io/skills/awais68-env-config/audits/11

BibTeX citation

@techreport{awais68-awais68-env-config-2026, author = {Awais68}, title = {env-config security audit report (audit version 11)}, institution = {Skillstore}, year = {2026}, number = {11}, url = {https://skillstore.io/skills/awais68-env-config/audits/11}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "env-config security audit report (audit version 11)" version: "unspecified" type: report authors: - name: "Awais68" date-released: "2026-07-09" url: "https://skillstore.io/skills/awais68-env-config/audits/11" identifiers: - type: other value: "skillstore:awais68-env-config:audit:11" description: "Skillstore immutable audit report identifier"

Compare variants

2 installable variants

Each author remains a separate installable skill. The recommended variant is ranked by Skillstore evidence.

Why this variant is first

Higher Skillstore usage
AutumnsGrove Recommended

autumnsgrove-env-config

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 23
Updated

2026-08-21

Awais68 Current

awais68-env-config

Skillstore Score 38
Evidence Confidence Medium
Skillstore usage 12
Updated

2026-08-21

Skillstore Score

Why this score Evidence Confidence: Medium
45
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance

What You Can Build

Bootstrap FastAPI Configuration

Create typed settings, required fields, and dotenv loading for a new FastAPI service.

Separate Deployment Environments

Plan local, staging, and production configuration files with clear ownership boundaries.

Review Secret Handling

Check that sensitive values use safer types, generated secrets, and non-committed local files.

Try These Prompts

Create a Starter Config 
Create a basic FastAPI environment configuration plan with required app, database, JWT, logging, and CORS settings.
Design a Settings Class 
Design a Pydantic settings class for my FastAPI service. Include required fields, defaults, validation notes, and secret handling.
Plan Multi-Environment Files 
Plan environment files for development, staging, and production. Explain which files may be committed and which must stay private.
Audit Existing Configuration 
Review my environment configuration design for security, deployment safety, validation gaps, and secret rotation risks.

Best Practices

  • Use committed templates for variable names and keep real .env files private.
  • Generate unique secrets for each environment and rotate them through controlled workflows.
  • Validate configuration at startup and redact secret values from logs and shared output.

Avoid

  • Copying sample secrets into staging or production deployments.
  • Committing local, staging, or production .env files with real credentials.
  • Using a file-writing rotation script without backups, path checks, or permission controls.

Frequently Asked Questions

Does this skill execute deployment commands?
No. It provides configuration guidance and examples for Python and FastAPI projects.
Can it manage production secrets directly?
No. It recommends production secret management patterns but does not call a secrets manager API.
Should I share real .env values with the assistant?
No. Share variable names, templates, or redacted values unless you explicitly approve secret handling.
Is the .env.example file safe to commit?
Yes, if it contains only variable names and placeholders, not real credentials.
What projects fit this skill best?
It fits Python and FastAPI services that use Pydantic settings and dotenv-style local configuration.
What should I review before using the rotation example?
Add backups, restrict file paths, validate keys, and avoid exposing secret values in logs or output.

Developer Details

Author

Awais68

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/Awais68/hackathon-2-phase-ii-full-stack-web-app/tree/main/.claude/skills/env-config

Ref

26421118b848d9f1efc0aa169d8a7a9e7e0a877e

Maintenance freshness

7/18/2026

Usage

6 downloads · 213 views

File structure

📁 scripts/

📄 verify.py

📄 SKILL.md

More from Awais68

View all

Related Skills

View all