Audit Env Variables

What it does

When your agent uses it

• Auditing .env files
• Reviewing security
• Documenting project configuration

Example prompts

• “/audit-env-variables”

Requirements

• A credential in API_KEY
• A credential in STRIPE_SECRET_KEY
• Pre-approved tools (allowed-tools): Read, Grep, Glob, Bash, Write, Edit, AskUserQuestion

Workflow steps

9 steps, taken from the step headings in SKILL.md.

1. 1Discover Environment Files
2. 2Extract Declared Variables
3. 3Find Code References
4. 4Cross-Reference Usage
5. 5Detect Services and Infer Permissions
6. 6Map Code Paths
7. 7Generate Report
8. 8Cleanup Unused Variables (Optional)
9. 9Regression Prevention

What it can do on your machine

Read from SKILL.md and the folder at commit e89b2f0. It shows what the files ask for, not the result of running them.

• Tool permissions

  Pre-approves these tools, so the agent can use them without asking each time:

  • Read
  • Grep
  • Glob
  • Bash
  • Write
  • Edit
  • AskUserQuestion

  From allowed-tools in the SKILL.md frontmatter.

• Runs code

  Shell commands in SKILL.md call:

  • npm
  • git

  From the folder's file list and the shell code blocks in SKILL.md.

• Network

  No URLs in SKILL.md. Its commands use npm and git, which can reach the network depending on how they are called.

  From URLs in SKILL.md, links to its own repository left out.

• Credentials

  Names these keys or tokens, usually read from environment variables:

  • OLD_API_KEY
  • API_KEY
  • STRIPE_SECRET_KEY

  From names ending in _API_KEY, _TOKEN, _SECRET, _KEY or _PASSWORD in SKILL.md.

Context cost

Audit Env Variables loads about 2.8k tokens when it runs, and up to ~4.8k if it reads all its reference files. Until then it costs about 94 tokens; SKILL.md has 828 words of instructions outside code blocks.

Always · name and description, kept in context so the agent knows when to use it

~94

When it runs · the whole SKILL.md, loaded when a task matches

~2.8k

With references · SKILL.md plus every file in references/, read only if the agent opens them

~4.8k

Estimates: characters ÷ 4, the usual rule of thumb; real counts depend on the model's tokenizer. Scripts and assets cost tokens only if the agent reads them.

Safety

• NoteMentions a .env fileSKILL.md:3

  regression detection. Use when auditing .env files, reviewing security, or documenting project configuration.

• NoteMentions a .env fileSKILL.md:22

  1. Scan for `.env*` files in project root

• NoteMentions a .env fileSKILL.md:41

  find . -maxdepth 2 -name ".env*" -o -name "env.d.ts" | grep -v node_modules

• NoteMentions a .env fileSKILL.md:45

  - `.env` - Local development

• NoteMentions a .env fileSKILL.md:46

  - `.env.local` - Local overrides

• NoteMentions a .env fileSKILL.md:47

  - `.env.development` / `.env.production` - Environment-specific

• NoteMentions a .env fileSKILL.md:100

  - Variables only in .env but not .env.example (documentation gap)

• NoteMentions a .env fileSKILL.md:152

  1. OLD_API_KEY (.env, .env.local)

• NoteMentions a .env fileSKILL.md:156

  2. DEPRECATED_SERVICE_URL (.env)

• NoteMentions a .env fileSKILL.md:190

  [ ] OLD_API_KEY - Remove from .env, .env.local

Automated static check — not a guarantee. Review scripts before installing. It scans the text of SKILL.md for risky patterns (piping downloads into a shell, reading credential files, hidden Unicode, destructive commands); files beside SKILL.md are not scanned.

SKILL.md

Without a licence we can't republish the file, so here is its outline and opening line. It has 828 words (~2,807 tokens).

name

audit-env-variables

allowed-tools

Read, Grep, Glob, Bash, Write, Edit, AskUserQuestion

argument-hint

[output-path] [--cleanup]

Read the full SKILL.md on GitHub

Files

SKILL.md and 2 other files (references) in .claude/skills/audit-env-variables of qdhenry/Claude-Command-Suite.

• SKILL.md
• references/service-patterns.md
• templates/env-audit-report.md

Open the folder on GitHubat commit e89b2f0