Environment Variables

Establishes secure management patterns for environment variables and secrets across project environments, enhancing security and compliance.

Install this skill

or

0/100

Security score

The Environment Variables skill was audited on Mar 1, 2026 and we found 88 security issues across 5 threat categories. Review the findings below before installing.

Categories Tested

Security Issues

medium line 359

Template literal with variable interpolation in command context

SourceSKILL.md

359	(err) => `${err.path.join('.')}: ${err.message}`

medium line 362

Template literal with variable interpolation in command context

SourceSKILL.md

362	`Environment variable validation failed:\n${errorMessages.join('\n')}`

medium line 421

Template literal with variable interpolation in command context

SourceSKILL.md

421	baseUrl: env.API_BASE_URL \|\| `${env.NEXT_PUBLIC_APP_URL}/api`,

medium line 492

Template literal with variable interpolation in command context

SourceSKILL.md

492	`Missing required environment variables: ${missing.join(', ')}`

medium line 700

Template literal with variable interpolation in command context

SourceSKILL.md

700	console.log(`${colors[color]}${message}${colors.reset}`);

medium line 717

Template literal with variable interpolation in command context

SourceSKILL.md

717	colorLog(`✅ ${file} exists`, 'green');

medium line 719

Template literal with variable interpolation in command context

SourceSKILL.md

719	colorLog(`❌ ${file} missing`, 'red');

medium line 741

Template literal with variable interpolation in command context

SourceSKILL.md

741	colorLog(`⚠️ ${file} exists (should not be committed)`, 'yellow');

medium line 744

Template literal with variable interpolation in command context

SourceSKILL.md

744	colorLog(`ℹ️ ${file} not found (expected for local development)`, 'cyan');

medium line 786

Template literal with variable interpolation in command context

SourceSKILL.md

786	colorLog(`✅ ${pattern} is ignored`, 'green');

medium line 788

Template literal with variable interpolation in command context

SourceSKILL.md

788	colorLog(`❌ ${pattern} is not ignored`, 'red');

medium line 818

Template literal with variable interpolation in command context

SourceSKILL.md

818	colorLog(`❌ Check failed with error: ${error.message}`, 'red');

medium line 825

Template literal with variable interpolation in command context

SourceSKILL.md

825	colorLog(`✅ Passed: ${passed}`, 'green');

medium line 826

Template literal with variable interpolation in command context

SourceSKILL.md

826	colorLog(`❌ Failed: ${failed}`, 'red');

medium line 827

Template literal with variable interpolation in command context

SourceSKILL.md

827	colorLog(`📈 Success Rate: ${((passed / (passed + failed)) * 100).toFixed(1)}%`,

medium line 887

Template literal with variable interpolation in command context

SourceSKILL.md

887	src={`https://www.googletagmanager.com/gtag/js?id=${NEXT_PUBLIC_GOOGLE_ANALYTICS_ID}`}

medium line 891

Template literal with variable interpolation in command context

SourceSKILL.md

891

__html: `

medium line 963

Template literal with variable interpolation in command context

SourceSKILL.md

963	console.log(`[LOG] ${message}`, data);

low line 685

Node child_process module reference

SourceSKILL.md

685	const { execSync } = require('child_process');

low line 105

Webhook reference - potential data exfiltration

SourceSKILL.md

105	STRIPE_WEBHOOK_SECRET=

low line 234

Webhook reference - potential data exfiltration

SourceSKILL.md

234	STRIPE_WEBHOOK_SECRET=whsec_your_webhook_secret

low line 311

Webhook reference - potential data exfiltration

SourceSKILL.md

311	STRIPE_WEBHOOK_SECRET: z.string().min(1).optional(),

low line 431

Webhook reference - potential data exfiltration

SourceSKILL.md

431	webhookSecret: env.STRIPE_WEBHOOK_SECRET,

low line 57

Access to .env file

SourceSKILL.md

57	mkdir -p .env.example

low line 58

Access to .env file

SourceSKILL.md

58	mkdir -p .env.local.example

low line 59

Access to .env file

SourceSKILL.md

59	mkdir -p .env.development.example

low line 60

Access to .env file

SourceSKILL.md

60	mkdir -p .env.test.example

low line 61

Access to .env file

SourceSKILL.md

61	mkdir -p .env.production.example

medium line 66

Access to .env file

SourceSKILL.md

66	Create `.env.example`:

medium line 148

Access to .env file

SourceSKILL.md

148	Create `.env.development.example`:

low line 152

Access to .env file

SourceSKILL.md

152	# Copy this to .env.development.local

medium line 177

Access to .env file

SourceSKILL.md

177	Create `.env.test.example`:

low line 181

Access to .env file

SourceSKILL.md

181	# Copy this to .env.test.local

medium line 201

Access to .env file

SourceSKILL.md

201	Create `.env.production.example`:

low line 205

Access to .env file

SourceSKILL.md

205	# Copy this to .env.production.local

low line 355

Access to .env file

SourceSKILL.md

355	return envSchema.parse(process.env);

low line 459

Access to .env file

SourceSKILL.md

459	return process.env.NODE_ENV === 'development';

low line 463

Access to .env file

SourceSKILL.md

463	return process.env.NODE_ENV === 'production';

low line 467

Access to .env file

SourceSKILL.md

467	return process.env.NODE_ENV === 'test';

low line 488

Access to .env file

SourceSKILL.md

488	const missing = requiredVars.filter(varName => !process.env[varName]);

low line 565

Access to .env file

SourceSKILL.md

565

...env,

low line 638

Access to .env file

SourceSKILL.md

638	### Development (.env.development.local)

low line 641

Access to .env file

SourceSKILL.md

641	### Test (.env.test.local)

low line 644

Access to .env file

SourceSKILL.md

644	### Production (.env.production.local)

low line 649

Access to .env file

SourceSKILL.md

649	- Never commit `.env.local` files to version control

low line 657

Access to .env file

SourceSKILL.md

657	1. Add the variable to the appropriate `.env.example` file

low line 666

Access to .env file

SourceSKILL.md

666	1. Check that you have the correct `.env.local` file

low line 707

Access to .env file

SourceSKILL.md

707	'.env.example',

low line 708

Access to .env file

SourceSKILL.md

708	'.env.development.example',

low line 709

Access to .env file

SourceSKILL.md

709	'.env.test.example',

low line 710

Access to .env file

SourceSKILL.md

710	'.env.production.example',

low line 731

Access to .env file

SourceSKILL.md

731	'.env.local',

low line 732

Access to .env file

SourceSKILL.md

732	'.env.development.local',

low line 733

Access to .env file

SourceSKILL.md

733	'.env.test.local',

low line 734

Access to .env file

SourceSKILL.md

734	'.env.production.local',

low line 776

Access to .env file

SourceSKILL.md

776	'.env.local',

low line 777

Access to .env file

SourceSKILL.md

777	'.env.development.local',

low line 778

Access to .env file

SourceSKILL.md

778	'.env.test.local',

low line 779

Access to .env file

SourceSKILL.md

779	'.env.production.local',

low line 854

Access to .env file

SourceSKILL.md

854	"env:setup": "cp .env.example .env.local && echo 'Environment variables configured. Please update .env.local with your values.'",

low line 855

Access to .env file

SourceSKILL.md

855	"env:dev": "cp .env.development.example .env.development.local && echo 'Development environment configured.'",

low line 856

Access to .env file

SourceSKILL.md

856	"env:test": "cp .env.test.example .env.test.local && echo 'Test environment configured.'",

low line 857

Access to .env file

SourceSKILL.md

857	"env:prod": "cp .env.production.example .env.production.local && echo 'Production environment configured.'",

medium line 1011

Access to .env file

SourceSKILL.md

1011	1. Never commit secrets - Use `.env.local` files

medium line 691

Hex-encoded characters

SourceSKILL.md

691	reset: '\x1b[0m',

medium line 692

Hex-encoded characters

SourceSKILL.md

692	red: '\x1b[31m',

medium line 693

Hex-encoded characters

SourceSKILL.md

693	green: '\x1b[32m',

medium line 694

Hex-encoded characters

SourceSKILL.md

694	yellow: '\x1b[33m',

medium line 695

Hex-encoded characters

SourceSKILL.md

695	blue: '\x1b[34m',

medium line 696

Hex-encoded characters

SourceSKILL.md

696	cyan: '\x1b[36m',

low line 80

External URL reference

SourceSKILL.md

80	NEXT_PUBLIC_APP_URL=http://localhost:3000

low line 85

External URL reference

SourceSKILL.md

85	API_BASE_URL=http://localhost:3000/api

low line 132

External URL reference

SourceSKILL.md

132	CORS_ORIGIN=http://localhost:3000

low line 155

External URL reference

SourceSKILL.md

155	NEXT_PUBLIC_SUPABASE_URL=http://localhost:54321

low line 161

External URL reference

SourceSKILL.md

161	NEXTAUTH_URL=http://localhost:3000

low line 164

External URL reference

SourceSKILL.md

164	NEXT_PUBLIC_APP_URL=http://localhost:3000

low line 184

External URL reference

SourceSKILL.md

184	NEXT_PUBLIC_SUPABASE_URL=http://localhost:54323

low line 189

External URL reference

SourceSKILL.md

189	NEXTAUTH_URL=http://localhost:3000

low line 192

External URL reference

SourceSKILL.md

192	NEXT_PUBLIC_APP_URL=http://localhost:3000

low line 208

External URL reference

SourceSKILL.md

208	NEXT_PUBLIC_SUPABASE_URL=https://your-project.supabase.co

low line 214

External URL reference

SourceSKILL.md

214	NEXTAUTH_URL=https://your-domain.com

low line 217

External URL reference

SourceSKILL.md

217	NEXT_PUBLIC_APP_URL=https://your-domain.com

low line 224

External URL reference

SourceSKILL.md

224	NEXT_PUBLIC_SENTRY_DSN=https://your-sentry-dsn

low line 237

External URL reference

SourceSKILL.md

237	NEXT_PUBLIC_STORAGE_URL=https://your-storage.s3.amazonaws.com

low line 254

External URL reference

SourceSKILL.md

254	LOGROCKET_URL=https://your-logrocket-url

low line 257

External URL reference

SourceSKILL.md

257	CORS_ORIGIN=https://your-domain.com

low line 262

External URL reference

SourceSKILL.md

262	VERCEL_URL=https://your-domain.com

low line 887

External URL reference

SourceSKILL.md

887	src={`https://www.googletagmanager.com/gtag/js?id=${NEXT_PUBLIC_GOOGLE_ANALYTICS_ID}`}

Scanned on Mar 1, 2026

View Security Dashboard

Install this skill with one command

/learn @coverage-creatives/environment-variables

Rate this skill

Categorydevelopment

UpdatedMarch 29, 2026

openclaw github-copilot codex chatgpt cursor windsurf cline roo-code amp backend api devops-sre backend-developer fullstack-developer supabase stripe development

Coverage-Creatives/zeus