varlock

npx skills add sickn33/agentic-awesome-skills --skill varlock --agent claude-code

Same command for any agent — swap --agent for codex, cursor, copilot.

# Varlock Security Skill Secure-by-default environment variable management for Claude Code sessions. > **Repository**: https://github.com/dmno-dev/varlock > **Documentation**: https://varlock.dev ## When to Use - You need to work with environment variables or secrets in a Claude Code session without exposing their values. - The task involves validating, loading, or auditing secrets while keeping them out of logs, diffs, and assistant context. - You want a secure-by-default workflow built around Varlock instead of direct `.env` inspection. ## Core Principle: Secrets Never Exposed When working with Claude, secrets must NEVER appear in: - Terminal output - Claude's input/output context - Log files or traces - Git commits or diffs - Error messages This skill ensures all sensitive data is properly protected. --- ## CRITICAL: Security Rules for Claude ### Rule 1: Never Echo Secrets ```bash # ❌ NEVER DO THIS - exposes secret to Claude's context echo $CLERK_SECRET_KEY cat .env | grep SECRET printenv | grep API # ✅ DO THIS - validates without exposing varlock load --quiet && echo "✓ Secrets validated" ``` ### Rule 2: Never Read .env Directly ```bash # ❌ NEVER DO THIS - exposes all secrets c

echo $CLERK_SECRET_KEY
cat .env | grep SECRET
printenv | grep API
varlock load --quiet && echo "✓ Secrets validated"
cat .env
less .env
Read tool on .env file
cat .env.schema
varlock load  # Shows masked values
test -n "$API_KEY" && echo "Key: $API_KEY"