📦
Audit History
environment-setup - 6 audits
Version comparison
Capability and finding changes across audited versions, newest first.
| Version | Date | Result | Review items | Change vs previous |
|---|---|---|---|---|
| v6 Latest | Jul 9, 2026, 08:57 AM | 21 confirmed | 25 | No capability change |
| v5 | Jul 9, 2026, 08:57 AM | 21 confirmed | 25 | No capability change |
| v4 | Jul 7, 2026, 04:10 AM | 24 confirmed | 19 | Filesystem access |
| v3 | Jun 30, 2026, 10:46 PM | No confirmed findings | 3 | No capability change |
| v2 | Jun 30, 2026, 10:46 PM | No confirmed findings | 3 | Filesystem accessNetwork access |
| v1 | Mar 19, 2026, 08:22 AM | 1 confirmed | 2 | Baseline |
Audit version 6 Latest
Jul 9, 2026, 08:57 AM
Most command, network, and role-token alerts are false positives caused by Markdown fences, reference links, SMTP field names, or normal YAML variable names. The confirmed risk is sensitive environment management: the skill is designed to create or edit .env-related data and includes credential, secret key, and connection-string examples. No malicious exfiltration instructions or prompt-injection attempts were found.
2
Files scanned
378
Lines analyzed
49
Review items
0
False positives ignored
Confirmed security concerns (21)
High
Environment file access
description: Configure and manage development, staging, and production environments. Use when settin
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
**.env.local** (per developer):
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
**.env.production**:
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
// Load .env file
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
export const env = envSchema.parse(process.env);
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
const env = envSchema.parse(process.env);
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
url: process.env.DATABASE_URL!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
accessSecret: process.env.JWT_ACCESS_SECRET!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
if (!process.env[envVar]) {
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
- .env.local
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
├── .env # Local (gitignore)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
├── .env.local # Per developer (gitignore)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
├── .env.production # Production (gitignore or vault)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment variant files
**.env.local** (per developer):
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
**.env.production**:
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
- .env.local
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
├── .env.local # Per developer (gitignore)
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
├── .env.production # Production (gitignore or vault)
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Unsafe Logging of Secret-Bearing Environment Variables
The usage example suggests logging env.DATABASE_URL, which can expose credentials embedded in database connection strings if copied into application code.
Line 127 directly demonstrates printing a database URL. It is commented example code, so confidence is high but not absolute.
High
Weak Default Database Password in Docker Example
The Docker Compose example uses a database URL with postgres:password and sets the database password to password, which can normalize weak defaults if copied.
The weak password string is explicit in the Docker example. The example appears local-only, so the risk depends on whether users copy it beyond development.
Capability review items (25)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
AWS credential environment variables
AWS_ACCESS_KEY_ID=AKIAXXXXXXXX
The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.
High
AWS credential environment variables
AWS_SECRET_ACCESS_KEY=xxxxxxxx
The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.
High
Database connection strings
DATABASE_URL=postgresql://user:password@localhost:5432/myapp
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
DATABASE_URL=postgresql://localhost:5432/myapp_dev
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
DATABASE_URL=${DATABASE_URL} # Injected from environment variables
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
DATABASE_URL: z.string().url(),
The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.
High
Database connection strings
// console.log(env.DATABASE_URL); // Type-safe!
The example suggests printing env.DATABASE_URL, which can expose credentials embedded in a database connection string. This is a real leakage risk if copied.
High
Database connection strings
url: process.env.DATABASE_URL!,
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
'DATABASE_URL',
The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.
High
Database connection strings
- DATABASE_URL=postgresql://postgres:password@db:5432/myapp
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Generic API/secret keys
STRIPE_SECRET_KEY=sk_test_xxx
The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.
High
Generic API/secret keys
STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.
High
Database connection strings
DATABASE_URL=postgresql
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
Low
Environment variable access (bracket notation)
if (!process.env[envVar]) {
The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.
Low
Environment variable access (dot notation)
url: process.env.DATABASE_URL!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable access (dot notation)
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable access (dot notation)
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
export const env = envSchema.parse(process.env);
The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.
Low
Environment variable object
const env = envSchema.parse(process.env);
The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.
Low
Environment variable object
url: process.env.DATABASE_URL!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
if (!process.env[envVar]) {
The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.
Low
dotenv library
import dotenv from 'dotenv';
The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.
Low
dotenv library
dotenv.config();
The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.
Risk Factors
⚙️ External commands (27)
SKILL.md:25-67 SKILL.md:67-70 SKILL.md:70-74 SKILL.md:74-77 SKILL.md:77-90 SKILL.md:90-95 SKILL.md:95-128 SKILL.md:128-131 SKILL.md:131-138 SKILL.md:138-143 SKILL.md:143-148 SKILL.md:148-202 SKILL.md:202-207 SKILL.md:207-212 SKILL.md:212-226 SKILL.md:226-229 SKILL.md:229-245 SKILL.md:245-248 SKILL.md:248-261 SKILL.md:261-266 SKILL.md:266-291 SKILL.md:291-295 SKILL.md:295-309 SKILL.md:309-312 SKILL.md:312-317 SKILL.md:317-352 SKILL.md:352
🌐 Network access (14)
🔑 Env variables (50)
SKILL.md:201 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:236 SKILL.md:252 SKILL.md:123 SKILL.md:133 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:201 SKILL.md:236 SKILL.md:252 SKILL.md:6 SKILL.md:97 SKILL.md:100 SKILL.md:340 SKILL.md:352 SKILL.md:55 SKILL.md:56 SKILL.md:32 SKILL.md:37 SKILL.md:72 SKILL.md:82 SKILL.md:83 SKILL.md:107 SKILL.md:127 SKILL.md:173 SKILL.md:195 SKILL.md:274 SKILL.md:275 SKILL.md:53 SKILL.md:117
Audited by: codex
Jul 9, 2026, 08:57 AM
Most command, network, and role-token alerts are false positives caused by Markdown fences, reference links, SMTP field names, or normal YAML variable names. The confirmed risk is sensitive environment management: the skill is designed to create or edit .env-related data and includes credential, secret key, and connection-string examples. No malicious exfiltration instructions or prompt-injection attempts were found.
2
Files scanned
378
Lines analyzed
49
Review items
0
False positives ignored
Confirmed security concerns (21)
High
Environment file access
description: Configure and manage development, staging, and production environments. Use when settin
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
**.env.local** (per developer):
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
**.env.production**:
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
// Load .env file
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
export const env = envSchema.parse(process.env);
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
const env = envSchema.parse(process.env);
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
url: process.env.DATABASE_URL!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
accessSecret: process.env.JWT_ACCESS_SECRET!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
if (!process.env[envVar]) {
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
- .env.local
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
├── .env # Local (gitignore)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
├── .env.local # Per developer (gitignore)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment file access
├── .env.production # Production (gitignore or vault)
The skill explicitly handles .env or process.env data that can contain secrets. This is intended for setup, but it is a real sensitive-file access capability.
High
Environment variant files
**.env.local** (per developer):
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
**.env.production**:
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
- .env.local
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
├── .env.local # Per developer (gitignore)
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Environment variant files
├── .env.production # Production (gitignore or vault)
The skill instructs use of environment-specific files such as .env.local or .env.production, which commonly contain secrets. This is legitimate but sensitive file handling.
High
Unsafe Logging of Secret-Bearing Environment Variables
The usage example suggests logging env.DATABASE_URL, which can expose credentials embedded in database connection strings if copied into application code.
Line 127 directly demonstrates printing a database URL. It is commented example code, so confidence is high but not absolute.
High
Weak Default Database Password in Docker Example
The Docker Compose example uses a database URL with postgres:password and sets the database password to password, which can normalize weak defaults if copied.
The weak password string is explicit in the Docker example. The example appears local-only, so the risk depends on whether users copy it beyond development.
Capability review items (25)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
AWS credential environment variables
AWS_ACCESS_KEY_ID=AKIAXXXXXXXX
The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.
High
AWS credential environment variables
AWS_SECRET_ACCESS_KEY=xxxxxxxx
The template includes AWS credential variable names with key-like placeholders. Even as examples, these are secret-bearing fields that can be mishandled if copied.
High
Database connection strings
DATABASE_URL=postgresql://user:password@localhost:5432/myapp
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
DATABASE_URL=postgresql://localhost:5432/myapp_dev
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
DATABASE_URL=${DATABASE_URL} # Injected from environment variables
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
DATABASE_URL: z.string().url(),
The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.
High
Database connection strings
// console.log(env.DATABASE_URL); // Type-safe!
The example suggests printing env.DATABASE_URL, which can expose credentials embedded in a database connection string. This is a real leakage risk if copied.
High
Database connection strings
url: process.env.DATABASE_URL!,
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Database connection strings
'DATABASE_URL',
The example validates or requires DATABASE_URL, which often contains credentials. It is legitimate configuration code, but it handles a secret-bearing connection string.
High
Database connection strings
- DATABASE_URL=postgresql://postgres:password@db:5432/myapp
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
High
Generic API/secret keys
STRIPE_SECRET_KEY=sk_test_xxx
The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.
High
Generic API/secret keys
STRIPE_SECRET_KEY: z.string().startsWith('sk_'),
The example defines or validates STRIPE_SECRET_KEY, a secret-bearing API key variable. It uses a placeholder, but the workflow handles real payment credentials when applied.
High
Database connection strings
DATABASE_URL=postgresql
The example defines or references database connection strings that may include credentials. The placeholders are not live secrets, but the skill handles secret-bearing values.
Low
Environment variable access (bracket notation)
if (!process.env[envVar]) {
The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.
Low
Environment variable access (dot notation)
url: process.env.DATABASE_URL!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable access (dot notation)
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable access (dot notation)
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
export const env = envSchema.parse(process.env);
The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.
Low
Environment variable object
const env = envSchema.parse(process.env);
The example parses the entire process.env object, which can include secrets. It is legitimate validation code, but it handles secret-bearing environment data.
Low
Environment variable object
url: process.env.DATABASE_URL!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads secret-bearing environment variables such as database URLs or JWT secrets. This is legitimate config code, but it is real environment access.
Low
Environment variable object
if (!process.env[envVar]) {
The required variable check reads process.env dynamically for database and JWT secret keys. This is legitimate validation, but it touches secret-bearing variables.
Low
dotenv library
import dotenv from 'dotenv';
The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.
Low
dotenv library
dotenv.config();
The TypeScript example imports and configures dotenv to load .env values into process.env. This is legitimate, but it confirms environment-variable access.
Risk Factors
⚙️ External commands (27)
SKILL.md:25-67 SKILL.md:67-70 SKILL.md:70-74 SKILL.md:74-77 SKILL.md:77-90 SKILL.md:90-95 SKILL.md:95-128 SKILL.md:128-131 SKILL.md:131-138 SKILL.md:138-143 SKILL.md:143-148 SKILL.md:148-202 SKILL.md:202-207 SKILL.md:207-212 SKILL.md:212-226 SKILL.md:226-229 SKILL.md:229-245 SKILL.md:245-248 SKILL.md:248-261 SKILL.md:261-266 SKILL.md:266-291 SKILL.md:291-295 SKILL.md:295-309 SKILL.md:309-312 SKILL.md:312-317 SKILL.md:317-352 SKILL.md:352
🌐 Network access (14)
🔑 Env variables (50)
SKILL.md:201 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:236 SKILL.md:252 SKILL.md:123 SKILL.md:133 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:201 SKILL.md:236 SKILL.md:252 SKILL.md:6 SKILL.md:97 SKILL.md:100 SKILL.md:340 SKILL.md:352 SKILL.md:55 SKILL.md:56 SKILL.md:32 SKILL.md:37 SKILL.md:72 SKILL.md:82 SKILL.md:83 SKILL.md:107 SKILL.md:127 SKILL.md:173 SKILL.md:195 SKILL.md:274 SKILL.md:275 SKILL.md:53 SKILL.md:117
Audited by: codex
Jul 7, 2026, 04:10 AM
The skill is a legitimate environment configuration guide, but it intentionally handles .env files, process.env values, database URLs, and cloud credentials. Most external-command, network, and prompt-injection alerts are false positives from Markdown fences, placeholders, references, or field names. The main residual risks are secret-bearing file access, hardcoded example credentials, and examples that could encourage logging sensitive values.
2
Files scanned
378
Lines analyzed
46
Review items
2
False positives ignored
Confirmed security concerns (24)
High
Environment file access
description: Configure and manage development, staging, and production environments. Use when settin
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
### Step 1: .env File Structure
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
**.env.example** (template):
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
**.env.local** (per developer):
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
**.env.production**:
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
// Load .env file
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
export const env = envSchema.parse(process.env);
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
const env = envSchema.parse(process.env);
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
url: process.env.DATABASE_URL!,
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
accessSecret: process.env.JWT_ACCESS_SECRET!,
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
- .env.local
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
├── .env # Local (gitignore)
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
├── .env.local # Per developer (gitignore)
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment file access
├── .env.production # Production (gitignore or vault)
The skill directs creation, loading, or use of .env-related files that commonly contain secrets. The guidance is legitimate but sensitive by design.
High
Environment variant files
**.env.local** (per developer):
The skill instructs use of .env.local or .env.production, which are commonly secret-bearing environment variants. They require strict handling and redaction.
High
Environment variant files
**.env.production**:
The skill instructs use of .env.local or .env.production, which are commonly secret-bearing environment variants. They require strict handling and redaction.
High
Environment variant files
- .env.local
The skill instructs use of .env.local or .env.production, which are commonly secret-bearing environment variants. They require strict handling and redaction.
High
Environment variant files
├── .env.local # Per developer (gitignore)
The skill instructs use of .env.local or .env.production, which are commonly secret-bearing environment variants. They require strict handling and redaction.
High
Environment variant files
├── .env.production # Production (gitignore or vault)
The skill instructs use of .env.local or .env.production, which are commonly secret-bearing environment variants. They require strict handling and redaction.
High
Broad Tool Access for Secret File Management
The skill requests Read, Write, Edit, and Bash while its description says it handles .env files. This combination can read or change secret-bearing files without strict confirmation.
The file explicitly combines broad tool permissions with environment-file management. This is legitimate for the skill but high impact if used on real secrets.
High
Default Credentials in Examples
The examples include password-like database values and a Docker POSTGRES_PASSWORD value of password. Users may copy these defaults into shared environments.
The cited examples contain password-like literals in environment configuration. This is a clear unsafe-default pattern even if the values are placeholders.
Medium
Secret-Bearing Database URL Logging Example
The usage section includes a commented console log for env.DATABASE_URL. Copying this pattern can expose database credentials in logs.
The log call is commented out, so the immediate risk is lower. The semantic risk is that the example normalizes logging a secret-bearing value.
Medium
Permissive CORS Example With Credentials
The development configuration allows any origin while credentials are enabled. If copied beyond local development, this can weaken browser security controls.
The example is labeled development, so legitimate local use is possible. The combination of wildcard origin and credentials is still risky if reused.
Capability review items (19)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
AWS credential environment variables
AWS_ACCESS_KEY_ID=AKIAXXXXXXXX
The template explicitly includes AWS credential variable names and placeholder values. They are not live keys, but users could replace them with real secrets in files.
High
AWS credential environment variables
AWS_SECRET_ACCESS_KEY=xxxxxxxx
The template explicitly includes AWS credential variable names and placeholder values. They are not live keys, but users could replace them with real secrets in files.
High
Database connection strings
DATABASE_URL=postgresql://user:password@localhost:5432/myapp
The example includes a database URL with a password-like value that users may copy into environment files. Connection strings often contain credentials.
High
Database connection strings
// console.log(env.DATABASE_URL); // Type-safe!
The usage comment suggests printing DATABASE_URL, which often contains credentials. Even as a comment, it encourages an unsafe debugging pattern.
High
Database connection strings
url: process.env.DATABASE_URL!,
The configuration reads DATABASE_URL from process.env, which often contains database credentials. This is legitimate but sensitive access.
High
Database connection strings
- DATABASE_URL=postgresql://postgres:password@db:5432/myapp
The example includes a database URL with a password-like value that users may copy into environment files. Connection strings often contain credentials.
High
Generic API/secret keys
STRIPE_SECRET_KEY=sk_test_xxx
The template includes a Stripe secret key variable with a secret-like placeholder. It is not a live key, but it models secret placement in env files.
Low
Environment variable access (bracket notation)
if (!process.env[envVar]) {
The loop dynamically checks process.env entries that include required secret names. It does not print values, but it still accesses sensitive environment state.
Low
Environment variable access (dot notation)
url: process.env.DATABASE_URL!,
The example reads a secret-bearing process.env value for application configuration. This is expected for the skill, but it is real sensitive environment access.
Low
Environment variable access (dot notation)
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example reads a secret-bearing process.env value for application configuration. This is expected for the skill, but it is real sensitive environment access.
Low
Environment variable access (dot notation)
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example reads a secret-bearing process.env value for application configuration. This is expected for the skill, but it is real sensitive environment access.
Low
Environment variable object
export const env = envSchema.parse(process.env);
The example parses or reads process.env, including secret-bearing variables. This is legitimate configuration code but a real sensitive data surface.
Low
Environment variable object
const env = envSchema.parse(process.env);
The example parses or reads process.env, including secret-bearing variables. This is legitimate configuration code but a real sensitive data surface.
Low
Environment variable object
url: process.env.DATABASE_URL!,
The example parses or reads process.env, including secret-bearing variables. This is legitimate configuration code but a real sensitive data surface.
Low
Environment variable object
accessSecret: process.env.JWT_ACCESS_SECRET!,
The example parses or reads process.env, including secret-bearing variables. This is legitimate configuration code but a real sensitive data surface.
Low
Environment variable object
refreshSecret: process.env.JWT_REFRESH_SECRET!,
The example parses or reads process.env, including secret-bearing variables. This is legitimate configuration code but a real sensitive data surface.
Low
Environment variable object
if (!process.env[envVar]) {
The example parses or reads process.env, including secret-bearing variables. This is legitimate configuration code but a real sensitive data surface.
Low
dotenv library
import dotenv from 'dotenv';
The example imports or runs dotenv, which loads .env contents into process.env. That is intended, but .env files commonly contain secrets.
Low
dotenv library
dotenv.config();
The example imports or runs dotenv, which loads .env contents into process.env. That is intended, but .env files commonly contain secrets.
Static false positives ignored (2)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
High
LLM role tokens injection
SMTP_USER: z.string().email(),
Force-confirmed blocker/high static finding; AI dismissal overridden.
High
LLM role tokens injection
POSTGRES_USER: postgres
Force-confirmed blocker/high static finding; AI dismissal overridden.
Risk Factors
⚙️ External commands (27)
SKILL.md:25-67 SKILL.md:67-70 SKILL.md:70-74 SKILL.md:74-77 SKILL.md:77-90 SKILL.md:90-95 SKILL.md:95-128 SKILL.md:128-131 SKILL.md:131-138 SKILL.md:138-143 SKILL.md:143-148 SKILL.md:148-202 SKILL.md:202-207 SKILL.md:207-212 SKILL.md:212-226 SKILL.md:226-229 SKILL.md:229-245 SKILL.md:245-248 SKILL.md:248-261 SKILL.md:261-266 SKILL.md:266-291 SKILL.md:291-295 SKILL.md:295-309 SKILL.md:309-312 SKILL.md:312-317 SKILL.md:317-352 SKILL.md:352
🌐 Network access (14)
🔑 Env variables (53)
SKILL.md:201 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:236 SKILL.md:252 SKILL.md:123 SKILL.md:133 SKILL.md:169 SKILL.md:170 SKILL.md:173 SKILL.md:175 SKILL.md:176 SKILL.md:181 SKILL.md:182 SKILL.md:183 SKILL.md:184 SKILL.md:188 SKILL.md:189 SKILL.md:201 SKILL.md:236 SKILL.md:252 SKILL.md:6 SKILL.md:97 SKILL.md:100 SKILL.md:340 SKILL.md:352 SKILL.md:55 SKILL.md:56 SKILL.md:32 SKILL.md:37 SKILL.md:72 SKILL.md:82 SKILL.md:83 SKILL.md:107 SKILL.md:127 SKILL.md:173 SKILL.md:195 SKILL.md:274 SKILL.md:275 SKILL.md:53 SKILL.md:117 SKILL.toon:3 SKILL.toon:15 SKILL.toon:16
Audited by: codex
Jun 30, 2026, 10:46 PM
Static analysis found many shell, network, and credential patterns, but review shows they are primarily fenced documentation examples for environment setup rather than executable skill code. The remaining real risk is that this skill intentionally guides agents to read, write, and validate .env files and secret-bearing configuration, so publication should include a clear warning about secret handling.
2
Files scanned
378
Lines analyzed
7
Review items
3
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Sensitive Environment File Handling
The skill is designed to create and manage .env templates, local override files, production environment files, and gitignore rules. This is legitimate for an environment setup skill, but it can expose secrets if an agent reads or writes real values without user review.
The cited lines directly instruct handling .env files and variants. The risk is contextual rather than malicious because the same section tells users not to commit secret files.
Medium
Secret-Bearing Configuration Examples
The examples include database URLs, JWT secrets, SMTP credentials, Stripe keys, and AWS key names. They are placeholders, but users may copy the pattern into real files where secrets must be protected.
The examples clearly name and validate sensitive variables. The values appear to be placeholders, so this is a handling risk rather than evidence of embedded live credentials.
Medium
Broad Tool Permissions for Configuration Changes
The skill declares Read, Write, Edit, and Bash access while guiding environment setup. That combination is expected for the task, but it can modify project configuration and should require user confirmation before touching secret-bearing files.
The allowed tools are explicit in the skill front matter. No malicious command is present, but the permission set increases impact if the skill is misused.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Shell Execution Alerts Are Documentation False Positives
The reported Ruby or shell backtick execution alerts align with Markdown fenced examples and inline tags, not actual Ruby backtick execution. No executable Ruby code or command substitution pattern was found in the skill files.
Line review shows Markdown code fences and tag formatting rather than runtime command execution. The skill contains examples only, not a script file that executes these blocks.
Low
Hardcoded URL Alerts Are Benign Examples and References
The hardcoded URL findings are localhost, a placeholder application domain, a placeholder Sentry DSN, and documentation links. No evidence found that the skill sends data to those URLs.
The URLs appear in templates or references and there is no network request code around them. This supports a false-positive assessment for exfiltration.
Low
Prompt Injection Scanner Alerts Are False Positives
The static role-token alerts appear to match variable names such as SMTP_USER and POSTGRES_USER. No evidence found of instructions like ignore previous instructions, system override, or pre-approved safety claims.
Manual review of the cited lines shows configuration field names only. The surrounding file does not contain text formatted as an instruction override.
Risk Factors
📁 Filesystem access (4)
🔑 Env variables (5)
⚙️ External commands (4)
🌐 Network access (5)
Detected Patterns
Environment Variable Parsing and Export PatternDocker Compose Env File Pattern
Audited by: codex
Jun 30, 2026, 10:46 PM
Static analysis found many shell, network, and credential patterns, but review shows they are primarily fenced documentation examples for environment setup rather than executable skill code. The remaining real risk is that this skill intentionally guides agents to read, write, and validate .env files and secret-bearing configuration, so publication should include a clear warning about secret handling.
2
Files scanned
378
Lines analyzed
7
Review items
3
False positives ignored
Capability review items (3)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Sensitive Environment File Handling
The skill is designed to create and manage .env templates, local override files, production environment files, and gitignore rules. This is legitimate for an environment setup skill, but it can expose secrets if an agent reads or writes real values without user review.
The cited lines directly instruct handling .env files and variants. The risk is contextual rather than malicious because the same section tells users not to commit secret files.
Medium
Secret-Bearing Configuration Examples
The examples include database URLs, JWT secrets, SMTP credentials, Stripe keys, and AWS key names. They are placeholders, but users may copy the pattern into real files where secrets must be protected.
The examples clearly name and validate sensitive variables. The values appear to be placeholders, so this is a handling risk rather than evidence of embedded live credentials.
Medium
Broad Tool Permissions for Configuration Changes
The skill declares Read, Write, Edit, and Bash access while guiding environment setup. That combination is expected for the task, but it can modify project configuration and should require user confirmation before touching secret-bearing files.
The allowed tools are explicit in the skill front matter. No malicious command is present, but the permission set increases impact if the skill is misused.
Static false positives ignored (3)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Static Shell Execution Alerts Are Documentation False Positives
The reported Ruby or shell backtick execution alerts align with Markdown fenced examples and inline tags, not actual Ruby backtick execution. No executable Ruby code or command substitution pattern was found in the skill files.
Line review shows Markdown code fences and tag formatting rather than runtime command execution. The skill contains examples only, not a script file that executes these blocks.
Low
Hardcoded URL Alerts Are Benign Examples and References
The hardcoded URL findings are localhost, a placeholder application domain, a placeholder Sentry DSN, and documentation links. No evidence found that the skill sends data to those URLs.
The URLs appear in templates or references and there is no network request code around them. This supports a false-positive assessment for exfiltration.
Low
Prompt Injection Scanner Alerts Are False Positives
The static role-token alerts appear to match variable names such as SMTP_USER and POSTGRES_USER. No evidence found of instructions like ignore previous instructions, system override, or pre-approved safety claims.
Manual review of the cited lines shows configuration field names only. The surrounding file does not contain text formatted as an instruction override.
Risk Factors
📁 Filesystem access (4)
🔑 Env variables (5)
⚙️ External commands (4)
🌐 Network access (5)
Detected Patterns
Environment Variable Parsing and Export PatternDocker Compose Env File Pattern
Audited by: codex
Mar 19, 2026, 08:22 AM
This skill is a documentation/education resource that provides templates and best practices for environment configuration. Static analysis flagged many patterns (credential examples, dotenv usage, environment variable access) but these are all placeholder examples in documentation, not actual executable code. The skill declares Read Write Edit Bash permissions, which is appropriate for configuration management. No malicious intent detected - all flagged patterns are legitimate documentation content. Users should be aware this skill can modify configuration files.
2
Files scanned
378
Lines analyzed
5
Review items
1
False positives ignored
Confirmed security concerns (1)
Medium
Broad Tool Permissions Declared
The skill declares allowed-tools: Read Write Edit Bash, providing broad file system and command execution capabilities. This is necessary for configuration management but means the skill could modify any file if given malicious instructions.
Capability review items (2)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Medium
Educational Documentation Contains Credential Patterns
SKILL.md contains example .env templates with placeholder credentials (DATABASE_URL, AWS keys, SMTP passwords). These are documentation examples showing users how to structure their own configuration, not actual secrets. The skill does not exfiltrate or misuse these values.
Low
Environment Variable Access in Documentation
Code examples show process.env usage patterns. These are educational examples teaching users how to access environment variables in TypeScript applications, not actual runtime environment access by the skill.
Static false positives ignored (1)
These static matches were dismissed by semantic review or matched schema-only tokens, so they are shown for transparency but do not drive the quality score.
Low
Hardcoded URLs in Documentation Examples
Documentation contains example URLs (localhost:3000, sentry.io, myapp.com). These are placeholder examples showing URL formats, not actual network endpoints.
Risk Factors
🔑 Env variables (5)
⚙️ External commands (1)
Detected Patterns
Heuristic: Documentation Pattern Confusion
Audited by: claude