env-secrets-manager

Manage environment-variable hygiene and secrets safety across local development and production. Practical auditing, drift awareness, rotation readiness. Use when auditing .env files for committed secrets, planning a credential rotation, debugging missing-env-var production incidents, or hardening a new project against secrets leakage.

Quality

70%

Does it follow best practices?

Run evals on this skill

Adds up to 20 points to the overall score

View guide

Securityby

—

The risk profile of this skill

Fix and improve this skill with Tessl

tessl review fix ./engineering/skills/env-secrets-manager/SKILL.md

Quality

Content

56%Weight 40%Scale 1-5

Reviews the quality of instructions and guidance provided to agents. Good implementation is clear, handles edge cases, and produces reliable results.

The skill is actionable and its destructive rotation workflow has proper verification, but SKILL.md is bloated with general security/DevOps encyclopedia content that Claude already knows and that should live in reference files. The overview-to-detail split is weak despite real bundle files existing.

Suggestions

Move the Cloud Secret Store Integration, CI/CD Secret Injection, Pre-Commit Secret Detection, and Audit Logging sections into reference files (or the existing references/) and replace them with one-line pointers, keeping SKILL.md a lean overview.

Add an explicit validate→fix→retry feedback loop to the Recommended Workflow (e.g., re-run env_auditor.py after fixes until clean) so the main workflow matches the rotation workflow's rigor.

Trim general-knowledge prose (what each cloud provider's secret service 'is best for') down to skill-specific guidance; assume Claude knows the major secret stores.

Dimension	Reasoning	Score
Conciseness	The body inlines large encyclopedic sections Claude already knows — a cloud secret-store provider comparison table, per-platform CI/CD injection patterns, gitleaks/detect-secrets configs, and per-provider audit-logging tables — so the majority of tokens are padding rather than skill-specific knowledge. Not score 3 because the verbosity is pervasive, not just a few trimmable spots; not score 1 because the env_auditor workflow and pitfalls are genuinely skill-specific.	2 / 5
Actionability	Quick Start gives real executable commands ('python3 scripts/env_auditor.py /path/to/repo --json') backed by an actual script, and the pre-commit section provides copy-paste TOML/YAML configs. Minor gaps keep it from 5: the cloud-store and audit sections are descriptive rather than instructional.	4 / 5
Workflow Clarity	The Secret Rotation Workflow is clearly sequenced and includes a real validation checkpoint ('Verify each consumer can authenticate' before 'Revoke the old credential only after all consumers are confirmed healthy'), satisfying the destructive-operation expectation. It is not 5 because the main Recommended Workflow and Emergency Checklist lack an explicit validate→fix→retry feedback loop.	4 / 5
Progressive Disclosure	Reference Docs and the scripts are real files and clearly signaled, but the body still inlines the cloud-store, rotation, CI/CD, pre-commit, and audit-logging deep dives that belong in separate reference files rather than in SKILL.md's overview. This matches 'content that should be separate is inline' rather than the well-split 4 anchor.	3 / 5
	Total	13 / 20 Passed

Description

83%Weight 40%Scale 1-5

Based on the skill's description, can an agent find and select it at the right time? Clear, specific descriptions lead to better discovery.

A strong description: it states a clear purpose and pairs it with an explicit, concrete 'Use when' trigger list. The main weakness is mild abstraction in the lead phrases and a few missing synonym trigger terms.

Dimension	Reasoning	Score
Specificity	The 'Use when' clause enumerates several concrete actions — 'auditing .env files for committed secrets', 'planning a credential rotation', 'debugging missing-env-var production incidents', 'hardening a new project against secrets leakage' — but the lead phrases ('environment-variable hygiene', 'drift awareness', 'rotation readiness') lean abstract, leaving minor coverage gaps that keep it below 5.	4 / 5
Completeness	It explicitly answers both 'what' ('Manage environment-variable hygiene and secrets safety... Practical auditing, drift awareness, rotation readiness') and 'when' with concrete trigger phrases in the 'Use when' clause, matching the top anchor.	5 / 5
Trigger Term Quality	It surfaces natural terms users would say ('.env files', 'committed secrets', 'credential rotation', 'missing-env-var production incidents', 'secrets leakage'), but misses common synonyms/variants like 'environment variables', 'env vars', 'leaked credentials', so a few natural terms are absent.	4 / 5
Distinctiveness Conflict Risk	The env/secrets niche with specific triggers (.env files, missing-env-var incidents, credential rotation) is mostly distinct, but it overlaps with closely related security skills such as the cross-referenced 'secrets-vault-manager', giving minor conflict risk.	4 / 5
	Total	17 / 20 Passed

Validation

100%

Warnings & errors only

Checks the skill against the spec for correct structure and formatting. All validation checks must pass before discovery and implementation can be scored.

Validation — 16 / 16 Passed

Validation for skill structure

No warnings or errors.

Repository: alirezarezvani/claude-skills
Path: engineering/skills/env-secrets-manager/SKILL.md
Commit: 19392f7

Reviewed: ~5 hours ago

Table of Contents

Discovery Implementation Validation

Is this your skill?

If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.