varlock

Name: varlock
Author: wrsmith108

30stars0forks

How to install varlock?

wrsmith108/varlock-claude-skill/varlock

$npx -y skills add wrsmith108/varlock-claude-skill --skill varlock

Installs into the current project.

Summary

Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".

Files · 1

View on GitHub

SKILL.md

1	# Varlock Security Skill
2
3	Secure-by-default environment variable management for Claude Code sessions.
4
5	> Repository: https://github.com/dmno-dev/varlock
6	> Documentation: https://varlock.dev
7
8	## Core Principle: Secrets Never Exposed
9
10	When working with Claude, secrets must NEVER appear in:
11	- Terminal output
12	- Claude's input/output context
13	- Log files or traces
14	- Git commits or diffs
15	- Error messages
16
17	This skill ensures all sensitive data is properly protected.
18
19	---
20
21	## CRITICAL: Security Rules for Claude
22
23	### Rule 1: Never Echo Secrets
24
25	```bash
26	# ❌ NEVER DO THIS - exposes secret to Claude's context
27	echo $CLERK_SECRET_KEY
28	cat .env \| grep SECRET
29	printenv \| grep API
30
31	# ✅ DO THIS - validates without exposing
32	varlock load --quiet && echo "✓ Secrets validated"
33	```
34
35	### Rule 2: Never Read .env Directly
36
37	```bash
38	# ❌ NEVER DO THIS - exposes all secrets
39	cat .env
40	less .env
41	Read tool on .env file
42
43	# ✅ DO THIS - read schema (safe) not values
44	cat .env.schema
45	varlock load # Shows masked values
46	```
47
48	### Rule 3: Use Varlock for Validation
49
50	```bash
51	# ❌ NEVER DO THIS - exposes secret in error
52	test -n "$API_KEY" && echo "Key: $API_KEY"
53
54	# ✅ DO THIS - Varlock validates and masks
55	varlock load
56	# Output shows: API_KEY 🔐sensitive └ ▒▒▒▒▒
57	```
58
59	### Rule 4: Never Include Secrets in Commands
60
61	```bash
62	# ❌ NEVER DO THIS - secret in command history
63	curl -H "Authorization: Bearer sk_live_xxx" https://api.example.com
64
65	# ✅ DO THIS - use environment variable
66	curl -H "Authorization: Bearer $API_KEY" https://api.example.com
67	# Or better: varlock run -- curl ...
68	```
69
70	---
71
72	## Quick Start
73
74	### Installation
75
76	```bash
77	# Install Varlock CLI
78	curl -sSfL https://varlock.dev/install.sh \| sh -s -- --force-no-brew
79
80	# Add to PATH (add to ~/.zshrc or ~/.bashrc)
81	export PATH="$HOME/.varlock/bin:$PATH"
82
83	# Verify
84	varlock --version
85	```
86
87	### Initialize Project
88
89	```bash
90	# Create .env.schema from existing .env
91	varlock init
92
93	# Or create manually
94	touch .env.schema
95	```
96
97	---
98
99	## Schema File: .env.schema
100
101	The schema defines types, validation, and sensitivity for each variable.
102
103	### Basic Structure
104
105	```bash
106	# Global defaults
107	# @defaultSensitive=true @defaultRequired=infer
108
109	# Application
110	# @type=enum(development,staging,production) @sensitive=false
111	NODE_ENV=development
112
113	# @type=port @sensitive=false
114	PORT=3000
115
116	# Database - SENSITIVE
117	# @type=url @required
118	DATABASE_URL=
119
120	# @type=string @required @sensitive
121	DATABASE_PASSWORD=
122
123	# API Keys - SENSITIVE
124	# @type=string(startsWith=sk_) @required @sensitive
125	STRIPE_SECRET_KEY=
126
127	# @type=string(startsWith=pk_) @sensitive=false
128	STRIPE_PUBLISHABLE_KEY=
129	```
130
131	### Security Annotations
132
133	\| Annotation \| Effect \| Use For \|
134	\|------------\|--------\|---------\|
135	\| `@sensitive` \| Redacted in all output \| API keys, passwords, tokens \|
136	\| `@sensitive=false` \| Shown in logs \| Public keys, non-secret config \|
137	\| `@defaultSensitive=true` \| All vars sensitive by default \| High-security projects \|
138
139	### Type Annotations
140
141	\| Type \| Validates \| Example \|
142	\|------\|-----------\|---------\|
143	\| `string` \| Any string \| `@type=string` \|
144	\| `string(startsWith=X)` \| Prefix validation \| `@type=string(startsWith=sk_)` \|
145	\| `string(contains=X)` \| Substring validation \| `@type=string(contains=+clerk_test)` \|
146	\| `url` \| Valid URL \| `@type=url` \|
147	\| `port` \| 1-65535 \| `@type=port` \|
148	\| `boolean` \| true/false \| `@type=boolean` \|
149	\| `enum(a,b,c)` \| One of values \| `@type=enum(dev,prod)` \|
150
151	---
152
153	## Safe Commands for Claude
154
155	### Validating Environment
156
157	```bash
158	# Check all variables (safe - masks sensitive values)
159	varlock load
160
161	# Quiet mode (no output on success)
162	varlock load --quiet
163
164	# Check specific environment
165	varlock load --env=production
166	```
167
168	### Running Commands with Secrets
169
170	```bash
171	# Inject validated env into command
172	varlock run -- npm start
173	varlock run -- node script.js
174	varlock run -- pytest
175
176	# Secrets are available to the command but never printed
177	```
178
179	### Checking Schema (Safe)
180
181	```bash
182	# Schema is safe to read - contains no values
183	cat .env.schema
184
185	# List expected variables
186	grep "^[A-Z]" .env.schema
187	```
188
189	---
190
191	## Common Patterns
192
193	### Pattern 1: Validate Before Operations
194
195	```bash
196	# Always validate environment first
197	varlock load --quiet \|\| {
198	echo "❌ Environment validation failed"
199	exit 1
200	}
201
202	# Then proceed with operation
203	npm run build
204	```
205
206	### Pattern 2: Safe Secret Rotation
207
208	```bash
209	# 1. Update secret in external source (1Password, AWS, etc.)
210	# 2. Update .env file manually (don't use Claude for this)
211	# 3. Validate new value works
212	varlock load
213
214	# 4. If using GitHub Secrets, sync (values not shown)
215	./scripts/update-github-secrets.sh
216	```
217
218	### Pattern 3: CI/CD Integration
219
220	```yaml
221	# GitHub Actions -

People who liked this also viewed

6 picks

Type

varlock

30stars0forks

View on GitHub

How to install varlock?

wrsmith108/varlock-claude-skill/varlock

$npx -y skills add wrsmith108/varlock-claude-skill --skill varlock

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Varlock Security Skill
2
3	Secure-by-default environment variable management for Claude Code sessions.
4
5	> Repository: https://github.com/dmno-dev/varlock
6	> Documentation: https://varlock.dev
7
8	## Core Principle: Secrets Never Exposed
9
10	When working with Claude, secrets must NEVER appear in:
11	- Terminal output
12	- Claude's input/output context
13	- Log files or traces
14	- Git commits or diffs
15	- Error messages
16
17	This skill ensures all sensitive data is properly protected.
18
19	---
20
21	## CRITICAL: Security Rules for Claude
22
23	### Rule 1: Never Echo Secrets
24
25	```bash
26	# ❌ NEVER DO THIS - exposes secret to Claude's context
27	echo $CLERK_SECRET_KEY
28	cat .env \| grep SECRET
29	printenv \| grep API
30
31	# ✅ DO THIS - validates without exposing
32	varlock load --quiet && echo "✓ Secrets validated"
33	```
34
35	### Rule 2: Never Read .env Directly
36
37	```bash
38	# ❌ NEVER DO THIS - exposes all secrets
39	cat .env
40	less .env
41	Read tool on .env file
42
43	# ✅ DO THIS - read schema (safe) not values
44	cat .env.schema
45	varlock load # Shows masked values
46	```
47
48	### Rule 3: Use Varlock for Validation
49
50	```bash
51	# ❌ NEVER DO THIS - exposes secret in error
52	test -n "$API_KEY" && echo "Key: $API_KEY"
53
54	# ✅ DO THIS - Varlock validates and masks
55	varlock load
56	# Output shows: API_KEY 🔐sensitive └ ▒▒▒▒▒
57	```
58
59	### Rule 4: Never Include Secrets in Commands
60
61	```bash
62	# ❌ NEVER DO THIS - secret in command history
63	curl -H "Authorization: Bearer sk_live_xxx" https://api.example.com
64
65	# ✅ DO THIS - use environment variable
66	curl -H "Authorization: Bearer $API_KEY" https://api.example.com
67	# Or better: varlock run -- curl ...
68	```
69
70	---
71
72	## Quick Start
73
74	### Installation
75
76	```bash
77	# Install Varlock CLI
78	curl -sSfL https://varlock.dev/install.sh \| sh -s -- --force-no-brew
79
80	# Add to PATH (add to ~/.zshrc or ~/.bashrc)
81	export PATH="$HOME/.varlock/bin:$PATH"
82
83	# Verify
84	varlock --version
85	```
86
87	### Initialize Project
88
89	```bash
90	# Create .env.schema from existing .env
91	varlock init
92
93	# Or create manually
94	touch .env.schema
95	```
96
97	---
98
99	## Schema File: .env.schema
100
101	The schema defines types, validation, and sensitivity for each variable.
102
103	### Basic Structure
104
105	```bash
106	# Global defaults
107	# @defaultSensitive=true @defaultRequired=infer
108
109	# Application
110	# @type=enum(development,staging,production) @sensitive=false
111	NODE_ENV=development
112
113	# @type=port @sensitive=false
114	PORT=3000
115
116	# Database - SENSITIVE
117	# @type=url @required
118	DATABASE_URL=
119
120	# @type=string @required @sensitive
121	DATABASE_PASSWORD=
122
123	# API Keys - SENSITIVE
124	# @type=string(startsWith=sk_) @required @sensitive
125	STRIPE_SECRET_KEY=
126
127	# @type=string(startsWith=pk_) @sensitive=false
128	STRIPE_PUBLISHABLE_KEY=
129	```
130
131	### Security Annotations
132
133	\| Annotation \| Effect \| Use For \|
134	\|------------\|--------\|---------\|
135	\| `@sensitive` \| Redacted in all output \| API keys, passwords, tokens \|
136	\| `@sensitive=false` \| Shown in logs \| Public keys, non-secret config \|
137	\| `@defaultSensitive=true` \| All vars sensitive by default \| High-security projects \|
138
139	### Type Annotations
140
141	\| Type \| Validates \| Example \|
142	\|------\|-----------\|---------\|
143	\| `string` \| Any string \| `@type=string` \|
144	\| `string(startsWith=X)` \| Prefix validation \| `@type=string(startsWith=sk_)` \|
145	\| `string(contains=X)` \| Substring validation \| `@type=string(contains=+clerk_test)` \|
146	\| `url` \| Valid URL \| `@type=url` \|
147	\| `port` \| 1-65535 \| `@type=port` \|
148	\| `boolean` \| true/false \| `@type=boolean` \|
149	\| `enum(a,b,c)` \| One of values \| `@type=enum(dev,prod)` \|
150
151	---
152
153	## Safe Commands for Claude
154
155	### Validating Environment
156
157	```bash
158	# Check all variables (safe - masks sensitive values)
159	varlock load
160
161	# Quiet mode (no output on success)
162	varlock load --quiet
163
164	# Check specific environment
165	varlock load --env=production
166	```
167
168	### Running Commands with Secrets
169
170	```bash
171	# Inject validated env into command
172	varlock run -- npm start
173	varlock run -- node script.js
174	varlock run -- pytest
175
176	# Secrets are available to the command but never printed
177	```
178
179	### Checking Schema (Safe)
180
181	```bash
182	# Schema is safe to read - contains no values
183	cat .env.schema
184
185	# List expected variables
186	grep "^[A-Z]" .env.schema
187	```
188
189	---
190
191	## Common Patterns
192
193	### Pattern 1: Validate Before Operations
194
195	```bash
196	# Always validate environment first
197	varlock load --quiet \|\| {
198	echo "❌ Environment validation failed"
199	exit 1
200	}
201
202	# Then proceed with operation
203	npm run build
204	```
205
206	### Pattern 2: Safe Secret Rotation
207
208	```bash
209	# 1. Update secret in external source (1Password, AWS, etc.)
210	# 2. Update .env file manually (don't use Claude for this)
211	# 3. Validate new value works
212	varlock load
213
214	# 4. If using GitHub Secrets, sync (values not shown)
215	./scripts/update-github-secrets.sh
216	```
217
218	### Pattern 3: CI/CD Integration
219
220	```yaml
221	# GitHub Actions -

People who liked this also viewed

6 picks

Type