← Back to Skills Marketplace
pioneer-weirdo

Safe .env Manager

by Pioneer · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ✓ Security Clean
133
Downloads
1
Stars
0
Active Installs
1
Versions
Install in OpenClaw
/install env-ops-standard
Description
Safe .env key-first operations (CRUD) with secret-safe defaults. Use when troubleshooting missing env keys, auth/config failures, or when asked to add/update...
README (SKILL.md)

env-ops-standard

Enforce a Key-First SOP for .env management.

Detailed naming/comment standard lives in:

  • {baseDir}/references/env-key-standard.md

When user asks about naming conventions, comment templates, key semantics clarity, or ambiguity prevention, read and follow that reference.

Workflow (mandatory)

  1. Run key discovery first (no values):
    • node {baseDir}/scripts/envsafe.js --file \x3CENV_FILE> keys
  2. Confirm target key exists/does not exist:
    • node {baseDir}/scripts/envsafe.js --file \x3CENV_FILE> exists KEY
  3. Then perform write operation only if needed:
    • set/update: set (new key must include --comment by default policy)
    • delete: unset
  4. Validate after every write:
    • node {baseDir}/scripts/envsafe.js --file \x3CENV_FILE> lint
  5. For org-wide consistency, run with policy + profile:
    • node {baseDir}/scripts/envsafe.js --policy /home/node/.openclaw/envsafe-policy.json --profile openclaw-core --file \x3CENV_FILE> doctor

Safety rules

  • Default env file: /home/node/.openclaw/.env unless user specifies otherwise.
  • Never print .env full content.
  • Never print raw secret values in chat/logs.
  • set defaults to stdin-only input. Passing value via argv requires explicit --allow-argv.
  • New keys require clear comments by default (--comment "...") to avoid ambiguity.
  • New key comments are policy-validated (default requires used-by and updated markers).
  • Key names must follow policy regex (default: ^[A-Z][A-Z0-9_]*$), no ad-hoc naming.
  • Writes are lock-guarded + atomic and create timestamped backups.
  • Backup retention is enforced (--backup-keep, --backup-ttl-days).
  • Protected keys are policy-controlled and cannot be unset unless --force is explicitly passed.
  • unset is destructive; confirm intent if user did not explicitly ask to remove key.

Commands

  • List keys (no values):
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env keys
  • Check key exists:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env exists OPENAI_API_KEY
  • Set/update key (safe stdin, default):
    • printf '%s' 'NEW_VALUE' | node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env set OPENAI_API_KEY --stdin
  • Add new key with mandatory comment (recommended):
    • printf '%s' 'NEW_VALUE' | node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env set NEW_PROVIDER_API_KEY --stdin --comment "Provider key for xxx integration"
  • Set only when missing:
    • printf '%s' 'NEW_VALUE' | node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env set OPENAI_API_KEY --stdin --if-missing
  • Remove key:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env unset OPENAI_API_KEY
  • Lint format/duplicates:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env lint
  • Health summary:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env doctor
  • Strict health check (CI/automation):
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env --strict doctor
  • Preview write without changing file:
    • ... set/unset ... --dry-run
  • Show effective policy:
    • node {baseDir}/scripts/envsafe.js --policy /home/node/.openclaw/envsafe-policy.json policy

Output contract

  • keys: one key per line
  • exists: prints present or missing
  • set/unset: prints changed count + backup file path
  • lint: prints OK if clean; otherwise prints findings and exits non-zero
Usage Guidance
This skill appears internally consistent and meant to manage .env files. Before installing: (1) Verify you trust the runtime environment because the tool will read and modify files you point it at (default: /home/node/.openclaw/.env). (2) Review the bundled script and your policy file if you will use custom --policy or --file paths to ensure audit logs or other fields don't accidentally include secret values. (3) Keep the audit/log and backup directory permissions restricted (mode 600 is used by default). (4) If you plan to allow autonomous agent invocation, be aware the agent could run these commands on any file the agent user can access — consider restricting access or testing in an isolated environment first.
Capability Analysis
Type: OpenClaw Skill Name: env-ops-standard Version: 1.0.0 The skill bundle provides a robust utility for managing environment variables in a structured and safe manner. The core script, `scripts/envsafe.js`, implements several safety features including atomic writes, file locking to prevent race conditions, automated backups with retention policies, and an audit log. It enforces strict naming conventions and mandatory commenting via a policy engine (`references/policy.example.json`). The instructions in `SKILL.md` explicitly forbid the AI agent from printing full secrets or environment file contents, emphasizing a 'Key-First' SOP that prioritizes security and metadata over raw value exposure.
Capability Assessment
✓ Purpose & Capability
Name/description (key-first .env CRUD with safe defaults) match the included script and reference files. The script manipulates .env files, applies policy, handles backups, locking, and audit logs — all coherent with the stated purpose.
ℹ Instruction Scope
SKILL.md restricts operations to listing keys, checking existence, set/unset, lint, doctor. It defaults to /home/node/.openclaw/.env but permits arbitrary --file paths; this is expected for a file manager but means the agent can read/modify any file path the runtime user allows. The docs emphasize never printing secret values; reviewing runtime call sites is recommended to ensure that audit/log fields do not include raw secret values.
✓ Install Mechanism
No install spec; the skill is instruction-only plus a bundled Node.js script. No network downloads or external package installs are requested.
✓ Credentials
The skill requests no environment variables or external credentials. It uses local filesystem paths for policy, backups, and audit logs which is proportional to its function.
✓ Persistence & Privilege
always:false and normal autonomous invocation. The skill writes files only under configured paths (defaults under /home/node/.openclaw) and does not attempt to modify other skills or system-wide agent settings.
How to Use
  1. Make sure OpenClaw is installed (local or Docker)
  2. Run the install command in chat: /install env-ops-standard
  3. After installation, invoke the skill by name or use /env-ops-standard
  4. Provide required inputs per the skill's parameter spec and get structured output
Version History
v1.0.0
Initial release of env-ops-standard for secure, policy-driven .env file management. - Enforces a key-first, secret-safe workflow for adding, updating, listing, and removing .env entries. - Never prints secret values; all set operations default to stdin-only and require explicit flags for value-in-argv or destructive changes. - Mandates comment and naming conventions, policy validation, and atomic writes with timestamped backups. - Includes commands for linting, health checks, dry-run previews, and policy inspection. - Ensures org-wide consistency and safety, especially when troubleshooting missing keys or configuration errors.
Metadata
Slug env-ops-standard
Version 1.0.0
License MIT-0
All-time Installs 0
Active Installs 0
Total Versions 1
Frequently Asked Questions

What is Safe .env Manager?

Safe .env key-first operations (CRUD) with secret-safe defaults. Use when troubleshooting missing env keys, auth/config failures, or when asked to add/update... It is an AI Agent Skill for Claude Code / OpenClaw, with 133 downloads so far.

How do I install Safe .env Manager?

Run "/install env-ops-standard" in the OpenClaw or Claude Code chat to install it in one step — no extra setup required.

Is Safe .env Manager free?

Yes, Safe .env Manager is completely free, licensed under MIT-0. You can download, install and use it at no cost.

Which platforms does Safe .env Manager support?

Safe .env Manager is cross-platform and runs anywhere OpenClaw / Claude Code is available (cross-platform).

Who created Safe .env Manager?

It is built and maintained by Pioneer (@pioneer-weirdo); the current version is v1.0.0.

More Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191115 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 Comments