"Works on my machine" often means a variable the code reads is missing from .env.example. This skill compares every variable your code reads with your example env file, finds the gaps and leftovers, and flags env mistakes that leak secrets.

Your agent runs a scanner on the project. It reads JavaScript, TypeScript, Python, PHP, Ruby, Go, Prisma and Compose files, your example env files and .gitignore. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. The report never prints values from your real .env files.

What it checks

BLOCK (fix before shipping)

• E01: a real-looking secret value in the example env file

• E02: a real .env file that .gitignore does not ignore

• E03: a secret-looking variable with a public prefix (NEXT_PUBLIC_, VITE_, REACT_APP_ and similar)

REVIEW (check before release)

• E11: a variable the code reads that the example file does not list

• E12: an example entry nothing reads

• E13: env variables used with no example file at all

• E14: the same key twice in the example file

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It finds variable names written literally in code. Names built at run time or read through config libraries are not seen. Every .gitignore in the project, and above it up to the repository root, is applied the way git applies it. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 14 files: SKILL.md, the scanner in scripts/ (2 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (9 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.