Skills environment-setup
📦

environment-setup

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Configure Environment Variables Safely

Environment setup can fail when variables, secrets, and deployment settings are inconsistent. This skill creates structured templates, validation guidance, and environment separation plans.

Supports: Claude Codex Code(CC)
⚠️ 38 Poor

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request
Review the Skillstore skill "environment-setup" from https://skillstore.io/skills/supercent-io-environment-setup.md and its manifest at https://skillstore.io/api/skills/supercent-io-environment-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/supercent-io-environment-setup.md Signed manifest GET /api/skills/supercent-io-environment-setup/manifest Signed lockfile GET /api/skills/supercent-io-environment-setup/lockfile

Test it

Using "environment-setup". I need environment variables for a new API service.

Expected outcome:

  • A grouped variable checklist for application, database, authentication, email, monitoring, and feature flags.
  • A placeholder-only template plan for local setup and shared documentation.
  • Notes that real secrets belong in a vault or deployment platform, not in committed files.

Using "environment-setup". Our app fails when required variables are missing.

Expected outcome:

A validation strategy that reports missing variable names, stops startup safely, and keeps secret values out of logs.

Using "environment-setup". We use Docker Compose for local development.

Expected outcome:

A local configuration plan with service-level variables, environment file guidance, and warnings about weak default passwords.

Security Audit

High Risk
v6 • 7/9/2026 Open versioned report

Most command, network, and role-token alerts are false positives caused by Markdown fences, reference links, SMTP field names, or normal YAML variable names. The confirmed risk is sensitive environment management: the skill is designed to create or edit .env-related data and includes credential, secret key, and connection-string examples. No malicious exfiltration instructions or prompt-injection attempts were found.

2
Files scanned
378
Lines analyzed
25
Review items
0
False positives ignored

Confirmed security concerns (21)

High
SKILL.md:3
Environment file access
description: Configure and manage development, staging, and production environments. Use when settin
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:69
Environment file access
**.env.local** (per developer):
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:76
Environment file access
**.env.production**:
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:99
Environment file access
// Load .env file
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:123
Environment file access
export const env = envSchema.parse(process.env);
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:133
Environment file access
const env = envSchema.parse(process.env);
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:173
Environment file access
url: process.env.DATABASE_URL!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:181
Environment file access
accessSecret: process.env.JWT_ACCESS_SECRET!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
Show all 21 confirmed findings
High
SKILL.md:182
Environment file access
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:201
Environment file access
if (!process.env[envVar]) {
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:277
Environment file access
- .env.local
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:298
Environment file access
├── .env # Local (gitignore)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:299
Environment file access
├── .env.local # Per developer (gitignore)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:300
Environment file access
├── .env.production # Production (gitignore or vault)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
SKILL.md:69
Environment variant files
**.env.local** (per developer):
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
SKILL.md:76
Environment variant files
**.env.production**:
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
SKILL.md:277
Environment variant files
- .env.local
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
SKILL.md:299
Environment variant files
├── .env.local # Per developer (gitignore)
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
SKILL.md:300
Environment variant files
├── .env.production # Production (gitignore or vault)
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
SKILL.md:127
Unsafe Logging of Secret-Bearing Environment Variables
The usage example suggests logging env.DATABASE_URL, which can expose credentials embedded in database connection strings if copied into application code.
Line 127 directly demonstrates printing a database URL. It is commented example code, so confidence is high but not absolute.
High
SKILL.md:274SKILL.md:286
Weak Default Database Password in Docker Example
The Docker Compose example uses a database URL with postgres:password and sets the database password to password, which can normalize weak defaults if copied.
The weak password string is explicit in the Docker example. The example appears local-only, so the risk depends on whether users copy it beyond development.
Capability review items (25)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High
SKILL.md:55
AWS credential environment variables
AWS_ACCESS_KEY_ID=AKIAXXXXXXXX
The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.
High
SKILL.md:56
AWS credential environment variables
AWS_SECRET_ACCESS_KEY=xxxxxxxx
The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.
High
SKILL.md:32
Database connection strings
DATABASE_URL=postgresql://user:password@localhost:5432/myapp
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
SKILL.md:72
Database connection strings
DATABASE_URL=postgresql://localhost:5432/myapp_dev
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
SKILL.md:82
Database connection strings
DATABASE_URL=${DATABASE_URL} # Injected from environment variables
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
SKILL.md:107
Database connection strings
DATABASE_URL: z.string().url(),
The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.
High
SKILL.md:127
Database connection strings
// console.log(env.DATABASE_URL); // Type-safe!
The example suggests printing env.DATABASE_URL, which can expose credentials embedded in a database connection string. This is a real leakage risk if copied.
High
SKILL.md:173
Database connection strings
url: process.env.DATABASE_URL!,
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
SKILL.md:195
Database connection strings
'DATABASE_URL',
The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.
High
SKILL.md:274
Database connection strings
- DATABASE_URL=postgresql://postgres:password@db:5432/myapp
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
SKILL.md:53
Generic API/secret keys
STRIPE_SECRET_KEY=sk_test_xxx
The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.
High
SKILL.md:117
Generic API/secret keys
STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.
High
SKILL.toon:15
Database connection strings
DATABASE_URL=postgresql
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
Low
SKILL.md:201
Environment variable access (bracket notation)
if (!process.env[envVar]) {
The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.
Low
SKILL.md:173
Environment variable access (dot notation)
url: process.env.DATABASE_URL!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
SKILL.md:181
Environment variable access (dot notation)
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
SKILL.md:182
Environment variable access (dot notation)
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
SKILL.md:123
Environment variable object
export const env = envSchema.parse(process.env);
The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.
Low
SKILL.md:133
Environment variable object
const env = envSchema.parse(process.env);
The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.
Low
SKILL.md:173
Environment variable object
url: process.env.DATABASE_URL!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
SKILL.md:181
Environment variable object
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
SKILL.md:182
Environment variable object
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
SKILL.md:201
Environment variable object
if (!process.env[envVar]) {
The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.
Low
SKILL.md:97
dotenv library
import dotenv from 'dotenv';
The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.
Low
SKILL.md:100
dotenv library
dotenv.config();
The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.

Risk Factors

⚙️ External commands (27)
SKILL.md:25-67 SKILL.md:67-70 SKILL.md:70-74 SKILL.md:74-77 SKILL.md:77-90 SKILL.md:90-95 SKILL.md:95-128 SKILL.md:128-131 SKILL.md:131-138 SKILL.md:138-143 SKILL.md:143-148 SKILL.md:148-202 SKILL.md:202-207 SKILL.md:207-212 SKILL.md:212-226 SKILL.md:226-229 SKILL.md:229-245 SKILL.md:245-248 SKILL.md:248-261 SKILL.md:261-266 SKILL.md:266-291 SKILL.md:291-295 SKILL.md:295-309 SKILL.md:309-312 SKILL.md:312-317 SKILL.md:317-352 SKILL.md:352
🌐 Network access (14)
SKILL.md:29 SKILL.md:61 SKILL.md:80 SKILL.md:340 SKILL.md:341 SKILL.md:342 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:112 SKILL.md:113 SKILL.md:114 SKILL.md:115
🔑 Env variables (50)
SKILL.md:201 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:236 SKILL.md:252 SKILL.md:123 SKILL.md:133 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:201 SKILL.md:236 SKILL.md:252 SKILL.md:6 SKILL.md:97 SKILL.md:100 SKILL.md:340 SKILL.md:352 SKILL.md:55 SKILL.md:56 SKILL.md:32 SKILL.md:37 SKILL.md:72 SKILL.md:82 SKILL.md:83 SKILL.md:107 SKILL.md:127 SKILL.md:173 SKILL.md:195 SKILL.md:274 SKILL.md:275 SKILL.md:53 SKILL.md:117
Audited by: codex View Audit History →
Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report
Security Assessment

Copy report link

https://skillstore.io/skills/supercent-io-environment-setup/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/supercent-io-environment-setup/security.svg)](https://skillstore.io/skills/supercent-io-environment-setup?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/supercent-io-environment-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-environment-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/supercent-io-environment-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
Academic citations (APA · BibTeX · CFF)

APA citation

supercent-io. (2026). environment-setup security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/supercent-io-environment-setup/audits/6

BibTeX citation

@techreport{supercent-io-supercent-io-environment-setup-2026, author = {supercent-io}, title = {environment-setup security audit report (audit version 6)}, institution = {Skillstore}, year = {2026}, number = {6}, url = {https://skillstore.io/skills/supercent-io-environment-setup/audits/6}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "environment-setup security audit report (audit version 6)" version: "unspecified" type: report authors: - name: "supercent-io" date-released: "2026-07-09" url: "https://skillstore.io/skills/supercent-io-environment-setup/audits/6" identifiers: - type: other value: "skillstore:supercent-io-environment-setup:audit:6" description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium
55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance

What You Can Build

Set up a new backend project

Create a clear variable list, template structure, and validation plan before the first deployment.

Separate deployment environments

Define safer differences between local, staging, and production configuration without mixing secrets.

Standardize team onboarding

Give new contributors a documented template and rules for local environment setup.

Try These Prompts

Create a basic template 
Create a placeholder-only environment template for my Node.js API with app, database, auth, logging, and monitoring variables.
Add runtime validation 
Design a TypeScript environment validation plan using Zod. Include required variables, defaults, and safe error handling without printing secrets.
Split deployment settings 
Plan development, staging, and production environment configuration for my app. Include file naming, secret storage rules, and deployment checks.
Audit an existing setup 
Review my environment configuration approach. Find unsafe logging, weak defaults, missing validation, risky Docker settings, and source control mistakes.

Best Practices

  • Use placeholders in templates and store real values in an approved secret manager.
  • Require confirmation before reading or editing any existing environment file.
  • Redact secret values from logs, review comments, and generated documentation.

Avoid

  • Printing database URLs, tokens, or passwords in examples or troubleshooting output.
  • Copying default passwords from examples into shared or production systems.
  • Committing environment files with local, staging, or production secrets to source control.

Frequently Asked Questions

Can this skill create a complete environment variable plan?
Yes. It can group variables, suggest defaults, and describe separate local, staging, and production settings.
Does this skill manage real secrets?
No. It provides structure and guidance. Real secrets should stay in a vault or deployment platform.
Can it help with TypeScript validation?
Yes. It includes validation patterns for required variables, defaults, and startup failures.
Is it safe to use on existing environment files?
Use caution. Confirm before reading or editing existing files, and never print secret values.
Does it support Docker Compose?
Yes. It includes local Docker Compose environment examples and guidance for env_file usage.
Which tools can use this skill?
The report lists support for Claude, Codex, and Claude Code.

Developer Details

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/supercent-io/skills-template/tree/main/.agent-skills/environment-setup/

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

8 downloads · 142 views

File structure

📄 SKILL.md

📄 SKILL.toon

More from supercent-io

View all

Related Skills

View all