env-manager
Manages and validates environment variables for applications, ensuring proper configuration and security best practices.
Install this skill
Security score
The env-manager skill was audited on Feb 28, 2026 and we found 35 security issues across 3 threat categories. Review the findings below before installing.
Categories Tested
Security Issues
Template literal with variable interpolation in command context
| 377 | require('dotenv').config({ path: `.env.${process.env.NODE_ENV}` }); |
Access to .env file
| 21 | - Create .env.example template |
Access to .env file
| 82 | ## .env.example Template |
Access to .env file
| 200 | const env = envalid.cleanEnv(process.env, { |
Access to .env file
| 295 | env_file = ".env" |
Access to .env file
| 316 | .env |
Access to .env file
| 317 | .env.local |
Access to .env file
| 318 | .env.*.local |
Access to .env file
| 338 | # - .env files (gitignored) |
Access to .env file
| 352 | # Encrypt sensitive .env files |
Access to .env file
| 354 | sops -e .env > .env.encrypted |
Access to .env file
| 358 | echo '.env' >> .gitattributes |
Access to .env file
| 364 | ### Multiple .env Files |
Access to .env file
| 366 | .env # Default (committed .env.example) |
Access to .env file
| 367 | .env.local # Local overrides (gitignored) |
Access to .env file
| 368 | .env.development # Development |
Access to .env file
| 369 | .env.staging # Staging |
Access to .env file
| 370 | .env.production # Production (never committed!) |
Access to .env file
| 376 | require('dotenv').config({ path: '.env.local' }); |
Access to .env file
| 377 | require('dotenv').config({ path: `.env.${process.env.NODE_ENV}` }); |
Access to .env file
| 378 | require('dotenv').config({ path: '.env' }); |
Access to .env file
| 386 | const apiKey = process.env.API_KEY; |
Access to .env file
| 389 | const apiKey = process.env.API_KEY; |
Access to .env file
| 402 | if (process.env.DEBUG === true) { } // Always false! |
Access to .env file
| 405 | const DEBUG = process.env.DEBUG === 'true'; |
Access to .env file
| 415 | const PORT = process.env.PORT || 3000; |
Access to .env file
| 416 | const LOG_LEVEL = process.env.LOG_LEVEL || 'info'; |
Access to .env file
| 417 | const ENABLE_CACHE = process.env.ENABLE_CACHE !== 'false'; // Default true |
Access to .env file
| 476 | cp .env.example .env.local |
Access to .env file
| 477 | # Edit .env.local with your local values |
Access to .env file
| 490 | - Use `.env.example` as template (committed to git) |
Access to .env file
| 491 | - Never commit actual `.env` files with secrets |
External URL reference
| 96 | APP_URL=http://localhost:3000 |
External URL reference
| 169 | # SENTRY_DSN=https://[email protected]/xxxxx |
External URL reference
| 176 | CORS_ORIGINS=http://localhost:3000,http://localhost:3001 |