技能 env-handler
📦

env-handler

内容修订 r1 高风险 🌐 网络访问🔑 环境变量⚙️ 外部命令

安全管理环境变量

环境变量通常会混合公共默认值和私密密钥。此技能指导 Claude、Codex 和 Claude Code 将模板与本地密钥分开保存。

支持: Claude Codex Code(CC)
⚠️ 38 差

使用我的智能体安装

将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。

智能体请求
Review the Skillstore skill "env-handler" from https://skillstore.io/skills/aayushbaniya2006-env-handler.md and its manifest at https://skillstore.io/api/skills/aayushbaniya2006-env-handler/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.

你的智能体仍应展示其计划，并按安全策略请求必要确认。

Agent 可读资源

当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。

Markdown 详情 GET /skills/aayushbaniya2006-env-handler.md 已签名 manifest GET /api/skills/aayushbaniya2006-env-handler/manifest 已签名 lockfile GET /api/skills/aayushbaniya2006-env-handler/lockfile

测试它

正在使用“env-handler”。 Add a sensitive token for a new image generation provider.

预期结果:

助手添加一个空的模板条目，然后要求用户将真实 token 放入本地被忽略的密钥文件中。

正在使用“env-handler”。 Review environment variables before deploying to Vercel.

预期结果:

助手区分公共默认值、空的密钥占位符和托管生产变量，然后列出任何缺失的设置步骤。

正在使用“env-handler”。 Check whether a new variable is safe to commit.

预期结果:

助手说明该值是公共值还是敏感值，并在该值必须保持私密时建议使用空占位符。

安全审计

高风险
v8 • 2026/7/4 打开版本化报告

The skill is documentation-only and I found no prompt injection, exfiltration intent, or executable command behavior. The main confirmed risk is legitimate but sensitive environment-file handling around .env and .env.local, which requires strong guardrails before publication.

2
已扫描文件
99
分析行数
0
复核项
0
已忽略误报

已确认安全问题 (26)

高
reference.md:7
Environment file access
| `.env` | Committed ✅ | **Template & Defaults** | `KEY=""` (Secrets)<br>`KEY="val"` (Defaults) |
The reference defines .env as a committed template for secret placeholders. This is legitimate, but it still directs agents toward sensitive configuration files that need strict handling.
高
reference.md:8
Environment file access
| `.env.local` | Ignored 🚫 | **Secrets & Overrides** | `KEY="sk-123..."`<br>`KEY="override"` |
The reference identifies .env.local as the location for real secrets and overrides. Skills that operate near this file can expose credentials if they read or print values.
高
reference.md:22
Environment file access
- In production (Vercel), variables from `.env.local` must be added to the **Project Settings > En
The line discusses copying .env.local values into Vercel settings. That workflow handles production secrets and requires user-controlled entry to avoid disclosure.
高
reference.md:23
Environment file access
- Variables in `.env` are automatically picked up if the file is committed, but usually, it's bett
The line discusses committed .env variables and deployment behavior. It is legitimate guidance, but mistakes could publish sensitive defaults.
高
reference.md:29
Environment file access
`.env`:
The example begins a .env block that includes secret placeholders. It is a safe pattern only if real values remain absent.
高
reference.md:42
Environment file access
`.env.local`:
The example begins a .env.local block, which is explicitly the local secrets file. Handling this file is sensitive even when the shown values are examples.
高
reference.md:8
Environment variant files
| `.env.local` | Ignored 🚫 | **Secrets & Overrides** | `KEY="sk-123..."`<br>`KEY="override"` |
This line names .env.local as the secrets and overrides file. That is a real sensitive-file scope even though the examples are placeholders.
高
reference.md:22
Environment variant files
- In production (Vercel), variables from `.env.local` must be added to the **Project Settings > En
The deployment note involves moving .env.local values into hosted environment settings. The workflow touches production secrets and needs explicit safeguards.
显示全部 26 条已确认问题
高
reference.md:42
Environment variant files
`.env.local`:
The referenced .env.local example is the secret-bearing environment variant. This is sensitive context, not ordinary documentation only.
高
SKILL.md:3
Environment file access
description: Manage environment variables securely. Handles distinction between .env (template) and
The skill description states it manages .env and .env.local distinctions. This is legitimate but confirms sensitive environment-file scope.
高
SKILL.md:9
Environment file access
1. **NO `.env.example`**: Do not create this file. Use `.env` as the template.
The instruction directs use of .env as the template file. Editing committed environment templates can leak secrets if safeguards are not followed.
高
SKILL.md:10
Environment file access
2. **Secrets in `.env.local`**: Actual sensitive values must live in `.env.local` (git-ignored).
The instruction explicitly identifies .env.local as the file holding actual sensitive values. Any agent workflow around that file requires caution.
高
SKILL.md:11
Environment file access
3. **Placeholders**: Every variable in `.env.local` MUST have a corresponding entry in `.env`.
The rule maps .env.local entries to .env placeholders. That requires reasoning about secret-bearing variables and can expose names or values if mishandled.
高
SKILL.md:20
Environment file access
1. **Update `.env`**:
The workflow tells the agent to update .env when adding a secret. This is sensitive configuration editing even when the intended value is empty.
高
SKILL.md:23
Environment file access
# .env
The cited .env example is part of the secret-variable workflow. It is safe only when the placeholder remains empty and no secret is committed.
高
SKILL.md:29
Environment file access
> "I have added `REPLICATE_API_TOKEN` to your `.env` file. Please open `.env.local` and add the actu
The instruction asks the user to add an actual token to .env.local. That is appropriate user-controlled handling, but it still concerns a secret-bearing file.
高
SKILL.md:34
Environment file access
1. **Update `.env`**:
The workflow directs edits to .env for configuration variables. It is lower concern than secrets, but still environment file modification.
高
SKILL.md:37
Environment file access
# .env
The cited .env example is an environment file block. It is a template example, but edits to this file can affect committed configuration.
高
SKILL.md:46
Environment file access
- [ ] Is the variable in `.env`?
The checklist requires checking whether a variable is in .env. This confirms the skill operates on environment files.
高
SKILL.md:47
Environment file access
- [ ] If sensitive, is the value in `.env` empty?
The checklist verifies that sensitive .env values are empty. That is good practice, but it still requires sensitive placeholder review.
高
SKILL.md:48
Environment file access
- [ ] Did I ask the user to update `.env.local`?
The checklist asks whether the user updated .env.local. This confirms the workflow touches the secret-file process.
高
SKILL.md:3
Environment variant files
description: Manage environment variables securely. Handles distinction between .env (template) and
The skill description distinguishes .env from .env.local. This confirms environment variant file handling within the skill scope.
高
SKILL.md:10
Environment variant files
2. **Secrets in `.env.local`**: Actual sensitive values must live in `.env.local` (git-ignored).
The rule states actual sensitive values must live in .env.local. This is a real secret-file workflow, not an unrelated mention.
高
SKILL.md:11
Environment variant files
3. **Placeholders**: Every variable in `.env.local` MUST have a corresponding entry in `.env`.
The rule links .env.local entries to .env placeholders. That variant-file relationship is sensitive because it tracks secret-bearing variables.
高
SKILL.md:29
Environment variant files
> "I have added `REPLICATE_API_TOKEN` to your `.env` file. Please open `.env.local` and add the actu
The user-facing message directs secret entry into .env.local. The skill avoids asking for the value in chat, but the file remains sensitive.
高
SKILL.md:48
Environment variant files
- [ ] Did I ask the user to update `.env.local`?
The checklist explicitly includes .env.local update confirmation. This is sensitive environment variant handling.

风险因素

🌐 网络访问 (2)
reference.md:36 SKILL.md:38
🔑 环境变量 (7)
reference.md:32 reference.md:45 reference.md:14 SKILL.md:42 SKILL.md:43 SKILL.md:42 SKILL.md:43
⚙️ 外部命令 (18)
SKILL.md:9 SKILL.md:10 SKILL.md:11 SKILL.md:12 SKILL.md:13 SKILL.md:18 SKILL.md:20 SKILL.md:22-25 SKILL.md:25-29 SKILL.md:29 SKILL.md:32-34 SKILL.md:34-36 SKILL.md:36-39 SKILL.md:39-42 SKILL.md:42-43 SKILL.md:43-46 SKILL.md:46-47 SKILL.md:47-48
审计者: codex 查看审计历史 →
分享与引用此报告

分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。

打开版本化报告
安全评估

复制报告链接

https://skillstore.io/skills/aayushbaniya2006-env-handler/audits/8?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Markdown 徽章

[![Skillstore security assessment](https://skillstore.io/badges/skills/aayushbaniya2006-env-handler/security.svg)](https://skillstore.io/skills/aayushbaniya2006-env-handler?utm_source=security_passport_badge)

HTML 徽章

<a href="https://skillstore.io/skills/aayushbaniya2006-env-handler?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/aayushbaniya2006-env-handler/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

嵌入卡片

<iframe src="https://skillstore.io/embed/skills/aayushbaniya2006-env-handler.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>
学术引用 (APA · BibTeX · CFF)

APA 引用

AayushBaniya2006. (2026). env-handler security audit report (audit version 8) [Author version unspecified]. Skillstore. https://skillstore.io/skills/aayushbaniya2006-env-handler/audits/8

BibTeX 引用

@techreport{aayushbaniya2006-aayushbaniya2006-env-handler-2026, author = {AayushBaniya2006}, title = {env-handler security audit report (audit version 8)}, institution = {Skillstore}, year = {2026}, number = {8}, url = {https://skillstore.io/skills/aayushbaniya2006-env-handler/audits/8}, note = {Author version unspecified} }

CITATION.cff

cff-version: 1.2.0 message: "If you use this Skill, cite its author and this versioned security audit report." title: "env-handler security audit report (audit version 8)" version: "unspecified" type: report authors: - name: "AayushBaniya2006" date-released: "2026-07-04" url: "https://skillstore.io/skills/aayushbaniya2006-env-handler/audits/8" identifiers: - type: other value: "skillstore:aayushbaniya2006-env-handler:audit:8" description: "Skillstore immutable audit report identifier"

Skillstore 评分

评分依据 证据置信度: 中
55
架构
85
可维护性
87
内容
71
社区
83
规范符合性

你能构建什么

安全添加密钥

向项目模板添加新的 API token 占位符，同时将实际值保存在本地被忽略的文件中。

标准化部署变量

审查哪些变量应放在已提交的模板、本地覆盖项和托管部署设置中。

审查配置变更

在代码审查或发布之前，检查环境变量变更是否存在密钥暴露风险。

试试这些提示

添加新密钥 
为名为 PAYMENT_API_KEY 的新敏感变量添加占位符。不要将真实值放入已提交文件，并告诉我应在本地哪里输入它。
添加公共设置 
为本地开发添加一个公共应用 URL 设置。使用此技能中的项目环境约定。
审计现有变量 
审查当前的环境变量设置。识别哪些条目应作为模板、本地密钥、公共值或部署设置。
准备部署检查清单 
在部署前准备一份环境变量发布检查清单。包括模板占位符、本地密钥、托管变量和最终安全检查。

最佳实践

  • 确保已提交的模板文件不包含真实密钥值。
  • 要求用户在本地输入密钥，而不是通过聊天发送密钥。
  • 在提交或部署之前审查环境文件变更。

避免

  • 不要将真实 API keys、tokens 或 passwords 放入已提交的环境文件。
  • 不要要求用户将密钥值粘贴到对话中。
  • 当项目标准使用 .env 时，不要创建重复的环境模板。

常见问题

此技能会管理真实密钥值吗？
不会。它指导密钥应存放在哪里，但用户应在本地输入真实值。
它可以创建 .env.example 文件吗？
不能。已记录的约定禁止 .env.example，并使用 .env 作为模板。
它适合用于公共客户端变量吗？
适合。它包含使用 NEXT_PUBLIC 前缀的公共变量指导。
它支持 Vercel 部署设置吗？
支持。它会提醒用户在 Vercel 项目设置中配置生产变量。
它会自动检测已泄露的凭据吗？
不会。它提供流程指导，但仍然需要单独的密钥扫描。
哪些助手可以使用此技能？
报告列出了对 Claude、Codex 和 Claude Code 的支持。

开发者详情

许可证

MIT

Skillstore 修订

r1

版本提示

作者未声明版本。

仓库

https://github.com/AayushBaniya2006/blinkfund/tree/main/.claude/skills/env-handler

引用

a29db30e42179ff8ed4d95c9dfba3704c22643d0

维护新鲜度

2026/7/18

使用量

6 次下载 · 278 次浏览

文件结构

📄 reference.md

📄 SKILL.md

AayushBaniya2006 的更多技能

查看全部

相关技能

查看全部