Securely Manage Environment Variables

Varlock Skill for Claude Code is a secure-by-default environment variable management skill that ensures secrets are never exposed in Claude sessions. It wraps Varlock to enforce secure patterns preventing secrets from leaking into terminal output, Claude's input/output context, log files or traces, or git commits and diffs - all common accidental-exposure paths when working with .env files in an AI-assisted terminal session.

The core principle is absolute: secrets must never appear in Claude's context. The skill enforces a direct substitution pattern for common risky commands - cat .env becomes cat .env.schema (schema only, no values), echo $SECRET becomes varlock load (masked validation), and printenv | grep API becomes varlock load | grep API (masked output).

# Validate all secrets (shows masked values)
varlock load

# Run command with secrets injected
varlock run -- npm start

# View schema (safe - no values)
cat .env.schema

Secrets are defined in a .env.schema file with type and sensitivity annotations: @sensitive masks the value in all output, @sensitive=false shows it (for genuinely public keys like NODE_ENV), @required enforces presence, and typed constraints like @type=string(startsWith=sk_) validate format (e.g. Stripe secret key prefixes) or @type=url for connection strings. For handling user requests that touch secrets, the skill has explicit response patterns: checking if a key is set uses varlock load | grep API_KEY, debugging auth runs a full varlock load validation, and requests to update a secret or view raw .env contents are declined in favor of cat .env.schema or asking the user to update the value manually themselves.

Use this skill whenever a Claude Code session works with environment variables or secrets - checking whether a key is configured, debugging authentication issues, or validating environment configuration - so that no actual secret value ever appears in the conversation, terminal output, or logs.

It requires the Varlock CLI installed and a .env.schema file defining the project's variables and their sensitivity. It is not a secrets manager or vault itself - it's a workflow guard that wraps existing .env-based configuration to keep values masked during AI-assisted sessions; the underlying secret storage and rotation are still the user's responsibility.

Inputs: a .env.schema file defining variable types, requirements, and sensitivity annotations.

Outputs: masked secret validation output (varlock load), commands run with real secrets injected without exposing them (varlock run), and safe, value-free schema inspection (cat .env.schema).

Wraps the Varlock CLI (by DMNO) for schema-based environment variable validation and secret masking.

Developers using Claude Code who need to work with environment variables and secrets without risking accidental exposure in terminal output, context, logs, or commits.