Skills environment-setup

📦

environment-setup

Content revision r1 High Risk ⚙️ External commands🌐 Network access🔑 Env variables

Configure Environment Variables Safely

Environment setup can fail when variables, secrets, and deployment settings are inconsistent. This skill creates structured templates, validation guidance, and environment separation plans.

Supports: Claude Codex Code(CC)

Stop for confirmation before installing.

Review the plan and obtain explicit user consent before changing files.

Install with my Agent

Copy this request to your Agent. It includes the canonical Skill page and manifest.

Agent request

Review the Skillstore skill "environment-setup" from https://skillstore.io/skills/supercent-io-environment-setup.md and its manifest at https://skillstore.io/api/skills/supercent-io-environment-setup/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

Your Agent should still show its plan and request any confirmation required by the security policy.

Agent-readable resources

Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.

Markdown detail GET /skills/supercent-io-environment-setup.md Signed manifest GET /api/skills/supercent-io-environment-setup/manifest Signed lockfile GET /api/skills/supercent-io-environment-setup/lockfile

Test it

Using "environment-setup". I need environment variables for a new API service.

Expected outcome:

A grouped variable checklist for application, database, authentication, email, monitoring, and feature flags.
A placeholder-only template plan for local setup and shared documentation.
Notes that real secrets belong in a vault or deployment platform, not in committed files.

Using "environment-setup". Our app fails when required variables are missing.

Expected outcome:

A validation strategy that reports missing variable names, stops startup safely, and keeps secret values out of logs.

Using "environment-setup". We use Docker Compose for local development.

Expected outcome:

A local configuration plan with service-level variables, environment file guidance, and warnings about weak default passwords.

Security Audit

High Risk

v6 • 7/9/2026 Open versioned report

Most command, network, and role-token alerts are false positives caused by Markdown fences, reference links, SMTP field names, or normal YAML variable names. The confirmed risk is sensitive environment management: the skill is designed to create or edit .env-related data and includes credential, secret key, and connection-string examples. No malicious exfiltration instructions or prompt-injection attempts were found.

2

Files scanned

378

Lines analyzed

25

Review items

0

False positives ignored

Confirmed security concerns (21)

High

Environment file access

description: Configure and manage development, staging, and production environments. Use when settin

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

**.env.local** (per developer):

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

**.env.production**:

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

// Load .env file

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

export const env = envSchema.parse(process.env);

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

const env = envSchema.parse(process.env);

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

url: process.env.DATABASE_URL!,

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

accessSecret: process.env.JWT_ACCESS_SECRET!,

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

Show all 21 confirmed findings

High

Environment file access

refreshSecret: process.env.JWT_REFRESH_SECRET!,

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

if (!process.env[envVar]) {

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

- .env.local

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

├── .env # Local (gitignore)

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

├── .env.local # Per developer (gitignore)

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment file access

├── .env.production # Production (gitignore or vault)

The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.

High

Environment variant files

**.env.local** (per developer):

The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.

High

Environment variant files

**.env.production**:

The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.

High

Environment variant files

- .env.local

The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.

High

Environment variant files

├── .env.local # Per developer (gitignore)

The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.

High

Environment variant files

├── .env.production # Production (gitignore or vault)

The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.

High

Unsafe Logging of Secret-Bearing Environment Variables

The usage example suggests logging env.DATABASE_URL, which can expose credentials embedded in database connection strings if copied into application code.

Line 127 directly demonstrates printing a database URL. It is commented example code, so confidence is high but not absolute.

High

SKILL.md:274 SKILL.md:286

Weak Default Database Password in Docker Example

The Docker Compose example uses a database URL with postgres:password and sets the database password to password, which can normalize weak defaults if copied.

The weak password string is explicit in the Docker example. The example appears local-only, so the risk depends on whether users copy it beyond development.

Capability review items (25)

These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.

High

AWS credential environment variables

AWS_ACCESS_KEY_ID=AKIAXXXXXXXX

The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.

High

AWS credential environment variables

AWS_SECRET_ACCESS_KEY=xxxxxxxx

The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.

High

Database connection strings

DATABASE_URL=postgresql://user:password@localhost:5432/myapp

The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.

High

Database connection strings

DATABASE_URL=postgresql://localhost:5432/myapp_dev

The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.

High

Database connection strings

DATABASE_URL=${DATABASE_URL} # Injected from environment variables

The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.

High

Database connection strings

DATABASE_URL: z.string().url(),

The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.

High

Database connection strings

// console.log(env.DATABASE_URL); // Type-safe!

The example suggests printing env.DATABASE_URL, which can expose credentials embedded in a database connection string. This is a real leakage risk if copied.

High

Database connection strings

url: process.env.DATABASE_URL!,

The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.

High

Database connection strings

'DATABASE_URL',

The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.

High

Database connection strings

- DATABASE_URL=postgresql://postgres:password@db:5432/myapp

The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.

High

Generic API/secret keys

STRIPE_SECRET_KEY=sk_test_xxx

The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.

High

Generic API/secret keys

STRIPE_SECRET_KEY: z.string().startsWith('sk_'),

The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.

High

Database connection strings

DATABASE_URL=postgresql

The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.

Low

Environment variable access (bracket notation)

if (!process.env[envVar]) {

The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.

Low

Environment variable access (dot notation)

url: process.env.DATABASE_URL!,

The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.

Low

Environment variable access (dot notation)

accessSecret: process.env.JWT_ACCESS_SECRET!,

The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.

Low

Environment variable access (dot notation)

refreshSecret: process.env.JWT_REFRESH_SECRET!,

The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.

Low

Environment variable object

export const env = envSchema.parse(process.env);

The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.

Low

Environment variable object

const env = envSchema.parse(process.env);

The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.

Low

Environment variable object

url: process.env.DATABASE_URL!,

The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.

Low

Environment variable object

accessSecret: process.env.JWT_ACCESS_SECRET!,

The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.

Low

Environment variable object

refreshSecret: process.env.JWT_REFRESH_SECRET!,

The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.

Low

Environment variable object

if (!process.env[envVar]) {

The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.

Low

dotenv library

import dotenv from 'dotenv';

The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.

Low

dotenv library

dotenv.config();

The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.

Risk Factors

⚙️ External commands (27)

🌐 Network access (14)

SKILL.md:29 SKILL.md:61 SKILL.md:80 SKILL.md:340 SKILL.md:341 SKILL.md:342 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:112 SKILL.md:113 SKILL.md:114 SKILL.md:115

🔑 Env variables (50)

Audited by: codex View Audit History →

Share & cite this report

Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.

Open versioned report

Security Assessment

Copy report link

https://skillstore.io/skills/supercent-io-environment-setup/audits/6?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown badge

[![Skillstore security assessment](https://skillstore.io/badges/skills/supercent-io-environment-setup/security.svg)](https://skillstore.io/skills/supercent-io-environment-setup?utm_source=security_passport_badge)

HTML badge

<a href="https://skillstore.io/skills/supercent-io-environment-setup?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/supercent-io-environment-setup/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Embed card

<iframe src="https://skillstore.io/embed/skills/supercent-io-environment-setup.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Academic citations (APA · BibTeX · CFF)

APA citation

supercent-io. (2026). environment-setup security audit report (audit version 6) [Author version unspecified]. Skillstore. https://skillstore.io/skills/supercent-io-environment-setup/audits/6

BibTeX citation

@techreport{supercent-io-supercent-io-environment-setup-2026,
  author = {supercent-io},
  title = {environment-setup security audit report (audit version 6)},
  institution = {Skillstore},
  year = {2026},
  number = {6},
  url = {https://skillstore.io/skills/supercent-io-environment-setup/audits/6},
  note = {Author version unspecified}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "environment-setup security audit report (audit version 6)"
version: "unspecified"
type: report
authors:
  - name: "supercent-io"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/supercent-io-environment-setup/audits/6"
identifiers:
  - type: other
    value: "skillstore:supercent-io-environment-setup:audit:6"
    description: "Skillstore immutable audit report identifier"

Skillstore Score

Why this score Evidence Confidence: Medium

55

Architecture

85

Maintainability

87

Content

69

Community

83

Spec Compliance

What You Can Build

Set up a new backend project

Create a clear variable list, template structure, and validation plan before the first deployment.

Separate deployment environments

Define safer differences between local, staging, and production configuration without mixing secrets.

Standardize team onboarding

Give new contributors a documented template and rules for local environment setup.

Try These Prompts

Create a basic template

Create a placeholder-only environment template for my Node.js API with app, database, auth, logging, and monitoring variables.

Add runtime validation

Design a TypeScript environment validation plan using Zod. Include required variables, defaults, and safe error handling without printing secrets.

Split deployment settings

Plan development, staging, and production environment configuration for my app. Include file naming, secret storage rules, and deployment checks.

Audit an existing setup

Review my environment configuration approach. Find unsafe logging, weak defaults, missing validation, risky Docker settings, and source control mistakes.

Best Practices

Use placeholders in templates and store real values in an approved secret manager.
Require confirmation before reading or editing any existing environment file.
Redact secret values from logs, review comments, and generated documentation.

Avoid

Printing database URLs, tokens, or passwords in examples or troubleshooting output.
Copying default passwords from examples into shared or production systems.
Committing environment files with local, staging, or production secrets to source control.

Frequently Asked Questions

Can this skill create a complete environment variable plan?

Yes. It can group variables, suggest defaults, and describe separate local, staging, and production settings.

Does this skill manage real secrets?

No. It provides structure and guidance. Real secrets should stay in a vault or deployment platform.

Can it help with TypeScript validation?

Yes. It includes validation patterns for required variables, defaults, and startup failures.

Is it safe to use on existing environment files?

Use caution. Confirm before reading or editing existing files, and never print secret values.

Does it support Docker Compose?

Yes. It includes local Docker Compose environment examples and guidance for env_file usage.

Which tools can use this skill?

The report lists support for Claude, Codex, and Claude Code.

Developer Details

Author

License

MIT

Skillstore revision

r1

Version notice

The author did not declare a version.

Repository

https://github.com/supercent-io/skills-template/tree/main/.agent-skills/environment-setup/

Ref

3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88

Maintenance freshness

7/18/2026

Usage

8 downloads · 142 views

File structure

📄 SKILL.toon