env-setup_skill

Overview

This skill scans a codebase for all referenced environment variables, generates a safe and informative .env.example, validates existing .env files, and checks that secrets are not committed. It classifies variables (secrets, service URLs, config, other), suggests safe defaults and placeholders, and flags missing or unused entries. The skill also verifies .gitignore protection and warns about secrets in git history.

How this skill works

The skill searches common code patterns across languages and config files to discover environment variable names and their reference locations. It extracts and deduplicates variable names, classifies them by pattern (SECRET, URL, CONFIG, OTHER), and builds a grouped .env.example with sensible defaults and secret placeholders. If .env files exist, it compares discovered variables to report missing, unused, and present values; it also verifies .gitignore and inspects git history for accidental commits.

When to use it

• Preparing a new project for onboarding or open source release.
• Auditing an existing repo to ensure secrets are not committed.
• Generating or refreshing .env.example after adding new integrations.
• Validating multiple environment files (development, production, test).
• Before merging or publishing to catch missing configuration early.

Best practices

• Always keep .env out of version control and add standard ignore lines if missing.
• Use placeholder values for secrets and clear warnings (e.g., change-me-in-production).
• Group variables by logical sections (app, database, auth, external services).
• Flag client-exposed vars (e.g., NEXT_PUBLIC_*) distinctly to avoid leaking secrets.
• Check git history if .env was ever committed and rotate compromised secrets promptly.

Example use cases

• Scan a mixed-language repo (Python, Node, Go) to generate a consolidated .env.example.
• Compare discovered variables to an existing .env and produce a validation report of missing and unused keys.
• Add standard .env ignore entries to .gitignore and warn about leaked files in git history.
• Validate environment variables referenced in docker-compose and shell scripts, including interpolated defaults.
• Produce categorized environment docs for onboarding new developers or CI configuration.