← 返回 Skills 市场
pioneer-weirdo

Safe .env Manager

作者 Pioneer · GitHub ↗ · v1.0.0 · MIT-0
cross-platform ✓ 安全检测通过
133
总下载
1
收藏
0
当前安装
1
版本数
在 OpenClaw 中安装
/install env-ops-standard
功能描述
Safe .env key-first operations (CRUD) with secret-safe defaults. Use when troubleshooting missing env keys, auth/config failures, or when asked to add/update...
使用说明 (SKILL.md)

env-ops-standard

Enforce a Key-First SOP for .env management.

Detailed naming/comment standard lives in:

  • {baseDir}/references/env-key-standard.md

When user asks about naming conventions, comment templates, key semantics clarity, or ambiguity prevention, read and follow that reference.

Workflow (mandatory)

  1. Run key discovery first (no values):
    • node {baseDir}/scripts/envsafe.js --file \x3CENV_FILE> keys
  2. Confirm target key exists/does not exist:
    • node {baseDir}/scripts/envsafe.js --file \x3CENV_FILE> exists KEY
  3. Then perform write operation only if needed:
    • set/update: set (new key must include --comment by default policy)
    • delete: unset
  4. Validate after every write:
    • node {baseDir}/scripts/envsafe.js --file \x3CENV_FILE> lint
  5. For org-wide consistency, run with policy + profile:
    • node {baseDir}/scripts/envsafe.js --policy /home/node/.openclaw/envsafe-policy.json --profile openclaw-core --file \x3CENV_FILE> doctor

Safety rules

  • Default env file: /home/node/.openclaw/.env unless user specifies otherwise.
  • Never print .env full content.
  • Never print raw secret values in chat/logs.
  • set defaults to stdin-only input. Passing value via argv requires explicit --allow-argv.
  • New keys require clear comments by default (--comment "...") to avoid ambiguity.
  • New key comments are policy-validated (default requires used-by and updated markers).
  • Key names must follow policy regex (default: ^[A-Z][A-Z0-9_]*$), no ad-hoc naming.
  • Writes are lock-guarded + atomic and create timestamped backups.
  • Backup retention is enforced (--backup-keep, --backup-ttl-days).
  • Protected keys are policy-controlled and cannot be unset unless --force is explicitly passed.
  • unset is destructive; confirm intent if user did not explicitly ask to remove key.

Commands

  • List keys (no values):
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env keys
  • Check key exists:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env exists OPENAI_API_KEY
  • Set/update key (safe stdin, default):
    • printf '%s' 'NEW_VALUE' | node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env set OPENAI_API_KEY --stdin
  • Add new key with mandatory comment (recommended):
    • printf '%s' 'NEW_VALUE' | node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env set NEW_PROVIDER_API_KEY --stdin --comment "Provider key for xxx integration"
  • Set only when missing:
    • printf '%s' 'NEW_VALUE' | node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env set OPENAI_API_KEY --stdin --if-missing
  • Remove key:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env unset OPENAI_API_KEY
  • Lint format/duplicates:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env lint
  • Health summary:
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env doctor
  • Strict health check (CI/automation):
    • node {baseDir}/scripts/envsafe.js --file /home/node/.openclaw/.env --strict doctor
  • Preview write without changing file:
    • ... set/unset ... --dry-run
  • Show effective policy:
    • node {baseDir}/scripts/envsafe.js --policy /home/node/.openclaw/envsafe-policy.json policy

Output contract

  • keys: one key per line
  • exists: prints present or missing
  • set/unset: prints changed count + backup file path
  • lint: prints OK if clean; otherwise prints findings and exits non-zero
安全使用建议
This skill appears internally consistent and meant to manage .env files. Before installing: (1) Verify you trust the runtime environment because the tool will read and modify files you point it at (default: /home/node/.openclaw/.env). (2) Review the bundled script and your policy file if you will use custom --policy or --file paths to ensure audit logs or other fields don't accidentally include secret values. (3) Keep the audit/log and backup directory permissions restricted (mode 600 is used by default). (4) If you plan to allow autonomous agent invocation, be aware the agent could run these commands on any file the agent user can access — consider restricting access or testing in an isolated environment first.
功能分析
Type: OpenClaw Skill Name: env-ops-standard Version: 1.0.0 The skill bundle provides a robust utility for managing environment variables in a structured and safe manner. The core script, `scripts/envsafe.js`, implements several safety features including atomic writes, file locking to prevent race conditions, automated backups with retention policies, and an audit log. It enforces strict naming conventions and mandatory commenting via a policy engine (`references/policy.example.json`). The instructions in `SKILL.md` explicitly forbid the AI agent from printing full secrets or environment file contents, emphasizing a 'Key-First' SOP that prioritizes security and metadata over raw value exposure.
能力评估
✓ Purpose & Capability
Name/description (key-first .env CRUD with safe defaults) match the included script and reference files. The script manipulates .env files, applies policy, handles backups, locking, and audit logs — all coherent with the stated purpose.
ℹ Instruction Scope
SKILL.md restricts operations to listing keys, checking existence, set/unset, lint, doctor. It defaults to /home/node/.openclaw/.env but permits arbitrary --file paths; this is expected for a file manager but means the agent can read/modify any file path the runtime user allows. The docs emphasize never printing secret values; reviewing runtime call sites is recommended to ensure that audit/log fields do not include raw secret values.
✓ Install Mechanism
No install spec; the skill is instruction-only plus a bundled Node.js script. No network downloads or external package installs are requested.
✓ Credentials
The skill requests no environment variables or external credentials. It uses local filesystem paths for policy, backups, and audit logs which is proportional to its function.
✓ Persistence & Privilege
always:false and normal autonomous invocation. The skill writes files only under configured paths (defaults under /home/node/.openclaw) and does not attempt to modify other skills or system-wide agent settings.
如何使用
  1. 确保已安装 OpenClaw（本地或 Docker 部署）
  2. 在对话框中输入安装命令：/install env-ops-standard
  3. 安装完成后，直接呼叫该 Skill 的名称或使用 /env-ops-standard 触发
  4. 根据 Skill 的参数说明提供必要输入，即可获得结构化输出
版本历史
v1.0.0
Initial release of env-ops-standard for secure, policy-driven .env file management. - Enforces a key-first, secret-safe workflow for adding, updating, listing, and removing .env entries. - Never prints secret values; all set operations default to stdin-only and require explicit flags for value-in-argv or destructive changes. - Mandates comment and naming conventions, policy validation, and atomic writes with timestamped backups. - Includes commands for linting, health checks, dry-run previews, and policy inspection. - Ensures org-wide consistency and safety, especially when troubleshooting missing keys or configuration errors.
元数据
Slug env-ops-standard
版本 1.0.0
许可证 MIT-0
累计安装 0
当前安装数 0
历史版本数 1
常见问题

Safe .env Manager 是什么？

Safe .env key-first operations (CRUD) with secret-safe defaults. Use when troubleshooting missing env keys, auth/config failures, or when asked to add/update... 它是一个面向 Claude Code / OpenClaw 的 AI Agent Skill 插件，目前累计下载 133 次。

如何安装 Safe .env Manager？

在 OpenClaw 或 Claude Code 对话框中运行命令「/install env-ops-standard」即可一键安装，无需额外配置。

Safe .env Manager 是免费的吗？

是的，Safe .env Manager 完全免费，采用 MIT-0 许可证，可自由下载、安装和使用。

Safe .env Manager 支持哪些平台？

Safe .env Manager 跨平台运行，可在任意部署了 OpenClaw / Claude Code 的环境中使用（cross-platform）。

谁开发了 Safe .env Manager？

由 Pioneer（@pioneer-weirdo）开发并维护，当前版本 v1.0.0。

推荐 Skills
self-improving agent
Captures learnings, errors, and corrections to enable continuous improvement. Use when: (1) A command or operation fails unexpectedly, (2) User corrects Clau...
⬇ 463283 · by pskoett
Skill Vetter
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope, and suspicious patterns.
⬇ 259410 · by spclaudehome
Polymarket
Query Polymarket prediction markets. Check odds, find trending markets, search events, track price movements.
⬇ 232503 · by joelchance
Self-Improving + Proactive Agent
Self-reflection + Self-criticism + Self-learning + Self-organizing memory. Agent evaluates its own work, catches mistakes, and improves permanently. Use when...
⬇ 200423 · by ivangdavila
Github
Interact with GitHub using the `gh` CLI. Use `gh issue`, `gh pr`, `gh run`, and `gh api` for issues, PRs, CI runs, and advanced queries.
⬇ 191113 · by steipete
ontology
Typed knowledge graph for structured agent memory and composable skills. Use when creating/querying entities (Person, Project, Task, Event, Document), linkin...
⬇ 190156 · by oswalpalash

💬 留言讨论