env-setup — Environment Variable Manager

Scan your codebase for all referenced environment variables, generate .env.example, validate your current .env, and ensure secrets aren't committed.

Steps

1. Scan Codebase for Environment Variables

Search for env var references across all common patterns:

# Node.js / JavaScript / TypeScript
grep -rn "process\.env\.\w\+" --include="*.js" --include="*.ts" --include="*.jsx" --include="*.tsx" . | grep -v node_modules | grep -v dist

# Python
grep -rn "os\.environ\|os\.getenv\|environ\.get" --include="*.py" . | grep -v __pycache__ | grep -v .venv

# Rust
grep -rn "env::var\|env::var_os\|dotenv" --include="*.rs" . | grep -v target

# Go
grep -rn "os\.Getenv\|os\.LookupEnv\|viper\." --include="*.go" . | grep -v vendor

# Docker / docker-compose
grep -rn "\${.*}" --include="*.yml" --include="*.yaml" docker-compose* 2>/dev/null

# General .env references in config files
grep -rn "env\." --include="*.toml" --include="*.yaml" --include="*.yml" . 2>/dev/null

Windows PowerShell alternative:

Get-ChildItem -Recurse -Include *.js,*.ts,*.jsx,*.tsx -Exclude node_modules,dist | Select-String "process\.env\.\w+"
Get-ChildItem -Recurse -Include *.py -Exclude __pycache__,.venv | Select-String "os\.environ|os\.getenv"

2. Extract Variable Names

Parse grep output to extract unique variable names:

• process.env.DATABASE_URL → DATABASE_URL
• os.environ.get("SECRET_KEY", "default") → SECRET_KEY (default: default)
• os.getenv("API_KEY") → API_KEY
• env::var("RUST_LOG") → RUST_LOG

Deduplicate and sort alphabetically. Note which file and line each var is referenced in.

3. Classify Variables

Categorize each variable:

4. Generate .env.example

Create .env.example with descriptions, categories, and safe defaults:

# ============================================
# Environment Configuration
# Generated by env-setup skill
# ============================================

# --- App Configuration ---
NODE_ENV=development
PORT=3000
LOG_LEVEL=info

# --- Database ---
DATABASE_URL=postgresql://user:password@localhost:5432/dbname

# --- Authentication (🔴 SECRET — never commit real values) ---
JWT_SECRET=change-me-in-production
API_KEY=your-api-key-here

# --- External Services ---
REDIS_URL=redis://localhost:6379

Rules:

• Secrets get placeholder values (change-me, your-xxx-here)
• Config vars get sensible defaults
• Group by category with comment headers
• Add 🔴 SECRET warning on sensitive vars