environment-setup
Configure Environment Variables Safely
Environment setup can fail when variables, secrets, and deployment settings are inconsistent. This skill creates structured templates, validation guidance, and environment separation plans.
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Review the Skillstore skill "environment-setup" from https://skillstore.io/skills/supercent-io-environment-setup.md and its manifest at https://skillstore.io/api/skills/supercent-io-environment-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "environment-setup". I need environment variables for a new API service.
Expected outcome:
- A grouped variable checklist for application, database, authentication, email, monitoring, and feature flags.
- A placeholder-only template plan for local setup and shared documentation.
- Notes that real secrets belong in a vault or deployment platform, not in committed files.
Using "environment-setup". Our app fails when required variables are missing.
Expected outcome:
A validation strategy that reports missing variable names, stops startup safely, and keeps secret values out of logs.
Using "environment-setup". We use Docker Compose for local development.
Expected outcome:
A local configuration plan with service-level variables, environment file guidance, and warnings about weak default passwords.
Security Audit
High RiskMost command, network, and role-token alerts are false positives caused by Markdown fences, reference links, SMTP field names, or normal YAML variable names. The confirmed risk is sensitive environment management: the skill is designed to create or edit .env-related data and includes credential, secret key, and connection-string examples. No malicious exfiltration instructions or prompt-injection attempts were found.
Confirmed security concerns (21)
Show all 21 confirmed findings
Capability review items (25)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Risk Factors
โ๏ธ External commands (27)
๐ Network access (14)
๐ Env variables (50)
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/supercent-io-environment-setup/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/supercent-io-environment-setup?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/supercent-io-environment-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-environment-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/supercent-io-environment-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA ยท BibTeX ยท CFF)
APA citation
supercent-io. (2026). environment-setup security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/supercent-io-environment-setup/audits/6BibTeX citation
@techreport{supercent-io-supercent-io-environment-setup-2026,
author = {supercent-io},
title = {environment-setup security audit report (audit version 6)},
institution = {Skillstore},
year = {2026},
number = {6},
url = {https://skillstore.io/skills/supercent-io-environment-setup/audits/6},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "environment-setup security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
- name: "supercent-io"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/supercent-io-environment-setup/audits/6"
identifiers:
- type: other
value: "skillstore:supercent-io-environment-setup:audit:6"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: MediumWhat You Can Build
Set up a new backend project
Create a clear variable list, template structure, and validation plan before the first deployment.
Separate deployment environments
Define safer differences between local, staging, and production configuration without mixing secrets.
Standardize team onboarding
Give new contributors a documented template and rules for local environment setup.
Try These Prompts
Create a placeholder-only environment template for my Node.js API with app, database, auth, logging, and monitoring variables.
Design a TypeScript environment validation plan using Zod. Include required variables, defaults, and safe error handling without printing secrets.
Plan development, staging, and production environment configuration for my app. Include file naming, secret storage rules, and deployment checks.
Review my environment configuration approach. Find unsafe logging, weak defaults, missing validation, risky Docker settings, and source control mistakes.
Best Practices
- Use placeholders in templates and store real values in an approved secret manager.
- Require confirmation before reading or editing any existing environment file.
- Redact secret values from logs, review comments, and generated documentation.
Avoid
- Printing database URLs, tokens, or passwords in examples or troubleshooting output.
- Copying default passwords from examples into shared or production systems.
- Committing environment files with local, staging, or production secrets to source control.
Frequently Asked Questions
Can this skill create a complete environment variable plan?
Does this skill manage real secrets?
Can it help with TypeScript validation?
Is it safe to use on existing environment files?
Does it support Docker Compose?
Which tools can use this skill?
Developer Details
Author
supercent-ioLicense
MIT
Skillstore revision
r1
Version notice
The author did not declare a version.
Repository
https://github.com/supercent-io/skills-template/tree/main/.agent-skills/environment-setup/Ref
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Maintenance freshness
7/18/2026
Usage
8 downloads ยท 142 views
File structure
๐ SKILL.md
๐ SKILL.toon