env-secrets-manager

What This Skill Does

The env-secrets-manager is a comprehensive engineering tool designed to harden application configuration and secure sensitive credentials. It standardizes the lifecycle of environment files (.env) by providing robust validation, automated example generation, and seamless integration with enterprise-grade secret managers like HashiCorp Vault, AWS SSM, and Doppler. Beyond configuration, the skill acts as an automated security auditor, scanning your git history for exposed credentials to prevent accidental leaks before they happen. It automates the tedious aspects of DevOps by enforcing consistent schema definitions for environment variables, ensuring that development, staging, and production environments remain synchronized without risking the exposure of production keys.

Installation

To install this skill, run the following command in your terminal using the OpenClaw CLI: clawhub install openclaw/skills/skills/alirezarezvani/env-secrets-manager

Use Cases

This skill is ideal for teams aiming to eliminate 'configuration drift' where code behaves differently across environments. It is best utilized during the initial project scaffolding phase to set up structural integrity for configurations. Furthermore, it is a critical tool for incident response; if a secret is accidentally committed, the skill provides a clear, automated workflow to rotate, revoke, and redeploy credentials across your entire infrastructure. It also aids developer onboarding by providing a structured roadmap of all necessary environment variables, effectively reducing the time spent debugging missing-key errors.

Example Prompts

1. "Scan my repository for any accidentally committed AWS keys or secret tokens in the last 50 commits."
2. "Generate an .env.example file based on my existing .env.local, stripping out all actual values while preserving my comments."
3. "Validate my current .env file against the project requirements and identify any missing mandatory variables for the production environment."

Tips & Limitations

To maximize the utility of this skill, ensure your .gitignore is configured correctly using the provided patterns to prevent local development secrets from ever hitting the repository. Note that while this skill excels at detecting leaks, it cannot 'un-commit' secrets already stored in your git history without a history rewrite (such as using BFG Repo-Cleaner or git-filter-repo). Always treat secret managers as the source of truth for production and use this skill to sync local environments rather than storing production secrets in static files.