# Configure Environment Variables Safely

Environment setup can fail when variables, secrets, and deployment settings are inconsistent. This skill creates structured templates, validation guidance, and environment separation plans.

## Install

```bash
npx skillstore add supercent-io/environment-setup
```

## Metadata

- Status: approved
- Slug: supercent-io-environment-setup
- Skillstore revision: r1
- Version status: missing
- Tree hash: 1bdf0d11a0cb5eb6c2d38cb53031bccd349c60721569a440b1d63a8eb9b4d311
- Author: supercent-io
- GitHub username: supercent-io
- License: MIT
- Repository: https://github.com/supercent-io/skills-template/tree/main/.agent-skills/environment-setup/
- Ref: 3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
- Supported tools: Claude, Codex, Claude Code
- Audit status: complete
- Agent install advisory: confirmation\_required
- Manual install advisory: allowed
- Artifact signature: available
- Audit attestation: unavailable
- Human verification: not\_verified
- Risk factors: external\_commands, network, env\_access
- Quality score: 38
- Quality tier: warning
- Public page: https://skillstore.pages.dev/skills/supercent-io-environment-setup
- Manifest: https://skillstore.pages.dev/api/skills/supercent-io-environment-setup/manifest

## Capabilities

- Creates a standard environment variable plan for development, staging, and production.
- Drafts placeholder-only environment templates for app, database, auth, email, API, and monitoring settings.
- Shows TypeScript and Zod validation patterns for required environment variables.
- Outlines per-environment configuration files for development and production behavior.
- Adds Docker Compose environment variable examples and .gitignore guidance.

## Use Cases

- Set up a new backend project: Create a clear variable list, template structure, and validation plan before the first deployment.
- Separate deployment environments: Define safer differences between local, staging, and production configuration without mixing secrets.
- Standardize team onboarding: Give new contributors a documented template and rules for local environment setup.

## Prompt Templates

### Create a basic template

```
Create a placeholder-only environment template for my Node.js API with app, database, auth, logging, and monitoring variables.
```

### Add runtime validation

```
Design a TypeScript environment validation plan using Zod. Include required variables, defaults, and safe error handling without printing secrets.
```

### Split deployment settings

```
Plan development, staging, and production environment configuration for my app. Include file naming, secret storage rules, and deployment checks.
```

### Audit an existing setup

```
Review my environment configuration approach. Find unsafe logging, weak defaults, missing validation, risky Docker settings, and source control mistakes.
```

## Limitations

- Does not rotate, store, or retrieve real secrets from a vault.
- Examples include placeholders and must be reviewed before production use.
- May need project-specific changes for frameworks, hosts, or secret managers.
- Requires careful handling of existing environment files to avoid exposing secrets.

## Best Practices

- Use placeholders in templates and store real values in an approved secret manager.
- Require confirmation before reading or editing any existing environment file.
- Redact secret values from logs, review comments, and generated documentation.

## Anti Patterns

- Printing database URLs, tokens, or passwords in examples or troubleshooting output.
- Copying default passwords from examples into shared or production systems.
- Committing environment files with local, staging, or production secrets to source control.

## Security Audit

- Audited at: 2026-07-09T08:57:49.983\+00:00
- Summary: Most command, network, and role-token alerts are false positives caused by Markdown fences, reference links, SMTP field names, or normal YAML variable names. The confirmed risk is sensitive environment management: the skill is designed to create or edit .env-related data and includes credential, secret key, and connection-string examples. No malicious exfiltration instructions or prompt-injection attempts were found.

## Stats

- Views: 142
- Downloads: 11
- Favorites: 0
- Popularity score: 0