[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6GDF8V57G62F3R1TNMXT53T":3,"skill-same:01M6GDF8V57G62F3R1TNMXT53T":69},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":28,"publishedAt":40,"linkOnly":41,"markdownContent":42,"markdownBody":43,"frontMatter":44,"refName":47,"commitSha":48,"skillDirectory":49,"forksCount":50,"repositoryHtmlUrl":51,"repositoryHomepageUrl":51,"ownerHtmlUrl":52,"ownerBlogUrl":6,"ownerDescription":53,"updatedAt":54,"install":55,"resources":68},"01M6GDF8V57G62F3R1TNMXT53T","varlock",null,"Secure-by-default environment variable management for Claude Code sessions.","Sam-06060\u002Fjarvis-assistant","Sam-06060","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F208600848?v=4","01M6CRKT7C7FXD21V6HXF293S0","Samson Frank Ganta","01M6CRKTBEKYFD8YX5Z1GT99EE",6,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fvarlock\u002FSKILL.md",[18,23],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000011","运维与部署","SCENARIO","使用场景",{"categoryNo":24,"categoryName":25,"taxonomyType":26,"taxonomyTypeDesc":27},"01JBSEEDCAT000000000000030","开发工程师","PROFESSION","适用职业",[5,29,30,31,32,33,34,35,36,37,38,39],"github","sessions","secure","code","dev","https","claude code sessions","management","environment","default","critical","2026-11-10 10:12:30",false,"---\nname: varlock\ndescription: \"Secure-by-default environment variable management for Claude Code sessions.\"\nrisk: critical\nsource: \"https:\u002F\u002Fgithub.com\u002Fdmno-dev\u002Fvarlock\"\nversion: 1.0.0\n---\n\n\u003C!-- security-allowlist: curl-pipe-bash -->\n\n# Varlock Security Skill\n\nSecure-by-default environment variable management for Claude Code sessions.\n\n> **Repository**: https:\u002F\u002Fgithub.com\u002Fdmno-dev\u002Fvarlock\n> **Documentation**: https:\u002F\u002Fvarlock.dev\n\n## When to Use\n\n- You need to work with environment variables or secrets in a Claude Code session without exposing their values.\n- The task involves validating, loading, or auditing secrets while keeping them out of logs, diffs, and assistant context.\n- You want a secure-by-default workflow built around Varlock instead of direct `.env` inspection.\n\n## Core Principle: Secrets Never Exposed\n\nWhen working with Claude, secrets must NEVER appear in:\n- Terminal output\n- Claude's input\u002Foutput context\n- Log files or traces\n- Git commits or diffs\n- Error messages\n\nThis skill ensures all sensitive data is properly protected.\n\n---\n\n## CRITICAL: Security Rules for Claude\n\n### Rule 1: Never Echo Secrets\n\n```bash\n# ❌ NEVER DO THIS - exposes secret to Claude's context\necho $CLERK_SECRET_KEY\ncat .env | grep SECRET\nprintenv | grep API\n\n# ✅ DO THIS - validates without exposing\nvarlock load --quiet && echo \"✓ Secrets validated\"\n```\n\n### Rule 2: Never Read .env Directly\n\n```bash\n# ❌ NEVER DO THIS - exposes all secrets\ncat .env\nless .env\nRead tool on .env file\n\n# ✅ DO THIS - read schema (safe) not values\ncat .env.schema\nvarlock load  # Shows masked values\n```\n\n### Rule 3: Use Varlock for Validation\n\n```bash\n# ❌ NEVER DO THIS - exposes secret in error\ntest -n \"$API_KEY\" && echo \"Key: $API_KEY\"\n\n# ✅ DO THIS - Varlock validates and masks\nvarlock load\n# Output shows: API_KEY ?sensitive └ ▒▒▒▒▒\n```\n\n### Rule 4: Never Include Secrets in Commands\n\n```bash\n# ❌ NEVER DO THIS - secret in command history\ncurl -H \"Authorization: Bearer sk_live_xxx\" https:\u002F\u002Fapi.example.com\n\n# ✅ DO THIS - use environment variable\ncurl -H \"Authorization: Bearer $API_KEY\" https:\u002F\u002Fapi.example.com\n# Or better: varlock run -- curl ...\n```\n\n---\n\n## Quick Start\n\n### Installation\n\n```bash\n# Install Varlock CLI\ncurl -sSfL https:\u002F\u002Fvarlock.dev\u002Finstall.sh | sh -s -- --force-no-brew\n\n# Add to PATH (add to ~\u002F.zshrc or ~\u002F.bashrc)\nexport PATH=\"$HOME\u002F.varlock\u002Fbin:$PATH\"\n\n# Verify\nvarlock --version\n```\n\n### Initialize Project\n\n```bash\n# Create .env.schema from existing .env\nvarlock init\n\n# Or create manually\ntouch .env.schema\n```\n\n---\n\n## Schema File: .env.schema\n\nThe schema defines types, validation, and sensitivity for each variable.\n\n### Basic Structure\n\n```bash\n# Global defaults\n# @defaultSensitive=true @defaultRequired=infer\n\n# Application\n# @type=enum(development,staging,production) @sensitive=false\nNODE_ENV=development\n\n# @type=port @sensitive=false\nPORT=3000\n\n# Database - SENSITIVE\n# @type=url @required\nDATABASE_URL=\n\n# @type=string @required @sensitive\nDATABASE_PASSWORD=\n\n# API Keys - SENSITIVE\n# @type=string(startsWith=sk_) @required @sensitive\nSTRIPE_SECRET_KEY=\n\n# @type=string(startsWith=pk_) @sensitive=false\nSTRIPE_PUBLISHABLE_KEY=\n```\n\n### Security Annotations\n\n| Annotation | Effect | Use For |\n|------------|--------|---------|\n| `@sensitive` | Redacted in all output | API keys, passwords, tokens |\n| `@sensitive=false` | Shown in logs | Public keys, non-secret config |\n| `@defaultSensitive=true` | All vars sensitive by default | High-security projects |\n\n### Type Annotations\n\n| Type | Validates | Example |\n|------|-----------|---------|\n| `string` | Any string | `@type=string` |\n| `string(startsWith=X)` | Prefix validation | `@type=string(startsWith=sk_)` |\n| `string(contains=X)` | Substring validation | `@type=string(contains=+clerk_test)` |\n| `url` | Valid URL | `@type=url` |\n| `port` | 1-65535 | `@type=port` |\n| `boolean` | true\u002Ffalse | `@type=boolean` |\n| `enum(a,b,c)` | One of values | `@type=enum(dev,prod)` |\n\n---\n\n## Safe Commands for Claude\n\n### Validating Environment\n\n```bash\n# Check all variables (safe - masks sensitive values)\nvarlock load\n\n# Quiet mode (no output on success)\nvarlock load --quiet\n\n# Check specific environment\nvarlock load --env=production\n```\n\n### Running Commands with Secrets\n\n```bash\n# Inject validated env into command\nvarlock run -- npm start\nvarlock run -- node script.js\nvarlock run -- pytest\n\n# Secrets are available to the command but never printed\n```\n\n### Checking Schema (Safe)\n\n```bash\n# Schema is safe to read - contains no values\ncat .env.schema\n\n# List expected variables\ngrep \"^[A-Z]\" .env.schema\n```\n\n---\n\n## Common Patterns\n\n### Pattern 1: Validate Before Operations\n\n```bash\n# Always validate environment first\nvarlock load --quiet || {\n  echo \"❌ Environment validation failed\"\n  exit 1\n}\n\n# Then proceed with operation\nnpm run build\n```\n\n### Pattern 2: Safe Secret Rotation\n\n```bash\n# 1. Update secret in external source (1Password, AWS, etc.)\n# 2. Update .env file manually (don't use Claude for this)\n# 3. Validate new value works\nvarlock load\n\n# 4. If using GitHub Secrets, sync (values not shown)\n.\u002Fscripts\u002Fupdate-github-secrets.sh\n```\n\n### Pattern 3: CI\u002FCD Integration\n\n```yaml\n# GitHub Actions - secrets from GitHub Secrets\n- name: Validate environment\n  env:\n    DATABASE_URL: ${{ secrets.DATABASE_URL }}\n    API_KEY: ${{ secrets.API_KEY }}\n  run: varlock load --quiet\n```\n\n### Pattern 4: Docker Integration\n\n```dockerfile\n# Install Varlock in container\nRUN curl -sSfL https:\u002F\u002Fvarlock.dev\u002Finstall.sh | sh -s -- --force-no-brew \\\n    && ln -s \u002Froot\u002F.varlock\u002Fbin\u002Fvarlock \u002Fusr\u002Flocal\u002Fbin\u002Fvarlock\n\n# Validate at container start\nCMD [\"varlock\", \"run\", \"--\", \"npm\", \"start\"]\n```\n\n---\n\n## Handling Secret-Related Tasks\n\n### When User Asks to \"Check if API key is set\"\n\n```bash\n# ✅ Safe approach\nvarlock load 2>&1 | grep \"API_KEY\"\n# Shows: ✅ API_KEY ?sensitive └ ▒▒▒▒▒\n\n# ❌ Never do\necho $API_KEY\n```\n\n### When User Asks to \"Debug authentication\"\n\n```bash\n# ✅ Safe approach - check presence and format\nvarlock load  # Validates types and required fields\n\n# Check if key has correct prefix (without showing value)\nvarlock load 2>&1 | grep -E \"(CLERK|AUTH)\"\n\n# ❌ Never do\nprintenv | grep KEY\n```\n\n### When User Asks to \"Update a secret\"\n\n```\nClaude should respond:\n\"I cannot directly modify secrets for security reasons. Please:\n1. Update the value in your .env file manually\n2. Or update in your secrets manager (1Password, AWS, etc.)\n3. Then run `varlock load` to validate\n\nI can help you update the .env.schema if you need to add new variables.\"\n```\n\n### When User Asks to \"Show me the .env file\"\n\n```\nClaude should respond:\n\"I won't read .env files directly as they contain secrets. Instead:\n- Run `varlock load` to see masked values\n- Run `cat .env.schema` to see the schema (safe)\n- I can help you modify .env.schema if needed\"\n```\n\n---\n\n## External Secret Sources\n\n### 1Password Integration\n\n```bash\n# In .env.schema\n# @type=string @sensitive\nAPI_KEY=exec('op read \"op:\u002F\u002Fvault\u002Fitem\u002Ffield\"')\n```\n\n### AWS Secrets Manager\n\n```bash\n# In .env.schema\n# @type=string @sensitive\nDB_PASSWORD=exec('aws secretsmanager get-secret-value --secret-id prod\u002Fdb')\n```\n\n### Environment-Specific Values\n\n```bash\n# In .env.schema\n# @type=url\nAPI_URL=env('API_URL_${NODE_ENV}', 'http:\u002F\u002Flocalhost:3000')\n```\n\n---\n\n## Troubleshooting\n\n### \"varlock: command not found\"\n\n```bash\n# Check installation\nls ~\u002F.varlock\u002Fbin\u002Fvarlock\n\n# Add to PATH\nexport PATH=\"$HOME\u002F.varlock\u002Fbin:$PATH\"\n\n# Or use full path\n~\u002F.varlock\u002Fbin\u002Fvarlock load\n```\n\n### \"Schema validation failed\"\n\n```bash\n# Check which variables are missing\u002Finvalid\nvarlock load  # Shows detailed errors\n\n# Common fixes:\n# - Add missing required variables to .env\n# - Fix type mismatches (port must be number)\n# - Check string prefixes match schema\n```\n\n### \"Sensitive value exposed in logs\"\n\n```bash\n# 1. Rotate the exposed secret immediately\n# 2. Check .env.schema has @sensitive annotation\n# 3. Ensure using varlock commands, not echo\u002Fcat\n\n# Add missing sensitivity:\n# Before: API_KEY=\n# After:  # @type=string @sensitive\n#         API_KEY=\n```\n\n---\n\n## npm Scripts\n\nAdd these to your package.json:\n\n```json\n{\n  \"scripts\": {\n    \"env:validate\": \"varlock load\",\n    \"env:check\": \"varlock load --quiet || echo 'Environment validation failed'\",\n    \"prestart\": \"varlock load --quiet\",\n    \"start\": \"varlock run -- node server.js\"\n  }\n}\n```\n\n---\n\n## Security Checklist for New Projects\n\n- [ ] Install Varlock CLI\n- [ ] Create `.env.schema` with all variables defined\n- [ ] Mark all secrets with `@sensitive` annotation\n- [ ] Add `@defaultSensitive=true` to schema header\n- [ ] Add `.env` to `.gitignore`\n- [ ] Commit `.env.schema` to version control\n- [ ] Add `npm run env:validate` to CI\u002FCD\n- [ ] Document secret rotation procedure\n- [ ] Never use `cat .env` or `echo $SECRET` in Claude sessions\n\n---\n\n## Quick Reference Card\n\n| Task | Safe Command |\n|------|-------------|\n| Validate all env vars | `varlock load` |\n| Quiet validation | `varlock load --quiet` |\n| Run with env | `varlock run -- \u003Ccmd>` |\n| View schema | `cat .env.schema` |\n| Check specific var | `varlock load \\| grep VAR_NAME` |\n\n| Never Do | Why |\n|----------|-----|\n| `cat .env` | Exposes all secrets |\n| `echo $SECRET` | Exposes to Claude context |\n| `printenv \\| grep` | Exposes matching secrets |\n| Read .env with tools | Secrets in Claude's context |\n| Hardcode in commands | In shell history |\n\n---\n\n## Integration with Other Skills\n\n### Clerk Skill\n- Test user passwords are `@sensitive`\n- Test emails are `@sensitive=false` (contain +clerk_test, not secret)\n- See: `~\u002F.claude\u002Fskills\u002Fclerk\u002FSKILL.md`\n\n### Docker Skill\n- Mount `.env` file, never copy secrets to image\n- Use `varlock run` as entrypoint\n- See: `~\u002F.claude\u002Fskills\u002Fdocker\u002FSKILL.md`\n\n---\n\n*Last updated: December 22, 2025*\n*Secure-by-default environment management for Claude Code*\n","\u003C!-- security-allowlist: curl-pipe-bash -->\n\n# Varlock Security Skill\n\nSecure-by-default environment variable management for Claude Code sessions.\n\n> **Repository**: https:\u002F\u002Fgithub.com\u002Fdmno-dev\u002Fvarlock\n> **Documentation**: https:\u002F\u002Fvarlock.dev\n\n## When to Use\n\n- You need to work with environment variables or secrets in a Claude Code session without exposing their values.\n- The task involves validating, loading, or auditing secrets while keeping them out of logs, diffs, and assistant context.\n- You want a secure-by-default workflow built around Varlock instead of direct `.env` inspection.\n\n## Core Principle: Secrets Never Exposed\n\nWhen working with Claude, secrets must NEVER appear in:\n- Terminal output\n- Claude's input\u002Foutput context\n- Log files or traces\n- Git commits or diffs\n- Error messages\n\nThis skill ensures all sensitive data is properly protected.\n\n---\n\n## CRITICAL: Security Rules for Claude\n\n### Rule 1: Never Echo Secrets\n\n```bash\n# ❌ NEVER DO THIS - exposes secret to Claude's context\necho $CLERK_SECRET_KEY\ncat .env | grep SECRET\nprintenv | grep API\n\n# ✅ DO THIS - validates without exposing\nvarlock load --quiet && echo \"✓ Secrets validated\"\n```\n\n### Rule 2: Never Read .env Directly\n\n```bash\n# ❌ NEVER DO THIS - exposes all secrets\ncat .env\nless .env\nRead tool on .env file\n\n# ✅ DO THIS - read schema (safe) not values\ncat .env.schema\nvarlock load  # Shows masked values\n```\n\n### Rule 3: Use Varlock for Validation\n\n```bash\n# ❌ NEVER DO THIS - exposes secret in error\ntest -n \"$API_KEY\" && echo \"Key: $API_KEY\"\n\n# ✅ DO THIS - Varlock validates and masks\nvarlock load\n# Output shows: API_KEY ?sensitive └ ▒▒▒▒▒\n```\n\n### Rule 4: Never Include Secrets in Commands\n\n```bash\n# ❌ NEVER DO THIS - secret in command history\ncurl -H \"Authorization: Bearer sk_live_xxx\" https:\u002F\u002Fapi.example.com\n\n# ✅ DO THIS - use environment variable\ncurl -H \"Authorization: Bearer $API_KEY\" https:\u002F\u002Fapi.example.com\n# Or better: varlock run -- curl ...\n```\n\n---\n\n## Quick Start\n\n### Installation\n\n```bash\n# Install Varlock CLI\ncurl -sSfL https:\u002F\u002Fvarlock.dev\u002Finstall.sh | sh -s -- --force-no-brew\n\n# Add to PATH (add to ~\u002F.zshrc or ~\u002F.bashrc)\nexport PATH=\"$HOME\u002F.varlock\u002Fbin:$PATH\"\n\n# Verify\nvarlock --version\n```\n\n### Initialize Project\n\n```bash\n# Create .env.schema from existing .env\nvarlock init\n\n# Or create manually\ntouch .env.schema\n```\n\n---\n\n## Schema File: .env.schema\n\nThe schema defines types, validation, and sensitivity for each variable.\n\n### Basic Structure\n\n```bash\n# Global defaults\n# @defaultSensitive=true @defaultRequired=infer\n\n# Application\n# @type=enum(development,staging,production) @sensitive=false\nNODE_ENV=development\n\n# @type=port @sensitive=false\nPORT=3000\n\n# Database - SENSITIVE\n# @type=url @required\nDATABASE_URL=\n\n# @type=string @required @sensitive\nDATABASE_PASSWORD=\n\n# API Keys - SENSITIVE\n# @type=string(startsWith=sk_) @required @sensitive\nSTRIPE_SECRET_KEY=\n\n# @type=string(startsWith=pk_) @sensitive=false\nSTRIPE_PUBLISHABLE_KEY=\n```\n\n### Security Annotations\n\n| Annotation | Effect | Use For |\n|------------|--------|---------|\n| `@sensitive` | Redacted in all output | API keys, passwords, tokens |\n| `@sensitive=false` | Shown in logs | Public keys, non-secret config |\n| `@defaultSensitive=true` | All vars sensitive by default | High-security projects |\n\n### Type Annotations\n\n| Type | Validates | Example |\n|------|-----------|---------|\n| `string` | Any string | `@type=string` |\n| `string(startsWith=X)` | Prefix validation | `@type=string(startsWith=sk_)` |\n| `string(contains=X)` | Substring validation | `@type=string(contains=+clerk_test)` |\n| `url` | Valid URL | `@type=url` |\n| `port` | 1-65535 | `@type=port` |\n| `boolean` | true\u002Ffalse | `@type=boolean` |\n| `enum(a,b,c)` | One of values | `@type=enum(dev,prod)` |\n\n---\n\n## Safe Commands for Claude\n\n### Validating Environment\n\n```bash\n# Check all variables (safe - masks sensitive values)\nvarlock load\n\n# Quiet mode (no output on success)\nvarlock load --quiet\n\n# Check specific environment\nvarlock load --env=production\n```\n\n### Running Commands with Secrets\n\n```bash\n# Inject validated env into command\nvarlock run -- npm start\nvarlock run -- node script.js\nvarlock run -- pytest\n\n# Secrets are available to the command but never printed\n```\n\n### Checking Schema (Safe)\n\n```bash\n# Schema is safe to read - contains no values\ncat .env.schema\n\n# List expected variables\ngrep \"^[A-Z]\" .env.schema\n```\n\n---\n\n## Common Patterns\n\n### Pattern 1: Validate Before Operations\n\n```bash\n# Always validate environment first\nvarlock load --quiet || {\n  echo \"❌ Environment validation failed\"\n  exit 1\n}\n\n# Then proceed with operation\nnpm run build\n```\n\n### Pattern 2: Safe Secret Rotation\n\n```bash\n# 1. Update secret in external source (1Password, AWS, etc.)\n# 2. Update .env file manually (don't use Claude for this)\n# 3. Validate new value works\nvarlock load\n\n# 4. If using GitHub Secrets, sync (values not shown)\n.\u002Fscripts\u002Fupdate-github-secrets.sh\n```\n\n### Pattern 3: CI\u002FCD Integration\n\n```yaml\n# GitHub Actions - secrets from GitHub Secrets\n- name: Validate environment\n  env:\n    DATABASE_URL: ${{ secrets.DATABASE_URL }}\n    API_KEY: ${{ secrets.API_KEY }}\n  run: varlock load --quiet\n```\n\n### Pattern 4: Docker Integration\n\n```dockerfile\n# Install Varlock in container\nRUN curl -sSfL https:\u002F\u002Fvarlock.dev\u002Finstall.sh | sh -s -- --force-no-brew \\\n    && ln -s \u002Froot\u002F.varlock\u002Fbin\u002Fvarlock \u002Fusr\u002Flocal\u002Fbin\u002Fvarlock\n\n# Validate at container start\nCMD [\"varlock\", \"run\", \"--\", \"npm\", \"start\"]\n```\n\n---\n\n## Handling Secret-Related Tasks\n\n### When User Asks to \"Check if API key is set\"\n\n```bash\n# ✅ Safe approach\nvarlock load 2>&1 | grep \"API_KEY\"\n# Shows: ✅ API_KEY ?sensitive └ ▒▒▒▒▒\n\n# ❌ Never do\necho $API_KEY\n```\n\n### When User Asks to \"Debug authentication\"\n\n```bash\n# ✅ Safe approach - check presence and format\nvarlock load  # Validates types and required fields\n\n# Check if key has correct prefix (without showing value)\nvarlock load 2>&1 | grep -E \"(CLERK|AUTH)\"\n\n# ❌ Never do\nprintenv | grep KEY\n```\n\n### When User Asks to \"Update a secret\"\n\n```\nClaude should respond:\n\"I cannot directly modify secrets for security reasons. Please:\n1. Update the value in your .env file manually\n2. Or update in your secrets manager (1Password, AWS, etc.)\n3. Then run `varlock load` to validate\n\nI can help you update the .env.schema if you need to add new variables.\"\n```\n\n### When User Asks to \"Show me the .env file\"\n\n```\nClaude should respond:\n\"I won't read .env files directly as they contain secrets. Instead:\n- Run `varlock load` to see masked values\n- Run `cat .env.schema` to see the schema (safe)\n- I can help you modify .env.schema if needed\"\n```\n\n---\n\n## External Secret Sources\n\n### 1Password Integration\n\n```bash\n# In .env.schema\n# @type=string @sensitive\nAPI_KEY=exec('op read \"op:\u002F\u002Fvault\u002Fitem\u002Ffield\"')\n```\n\n### AWS Secrets Manager\n\n```bash\n# In .env.schema\n# @type=string @sensitive\nDB_PASSWORD=exec('aws secretsmanager get-secret-value --secret-id prod\u002Fdb')\n```\n\n### Environment-Specific Values\n\n```bash\n# In .env.schema\n# @type=url\nAPI_URL=env('API_URL_${NODE_ENV}', 'http:\u002F\u002Flocalhost:3000')\n```\n\n---\n\n## Troubleshooting\n\n### \"varlock: command not found\"\n\n```bash\n# Check installation\nls ~\u002F.varlock\u002Fbin\u002Fvarlock\n\n# Add to PATH\nexport PATH=\"$HOME\u002F.varlock\u002Fbin:$PATH\"\n\n# Or use full path\n~\u002F.varlock\u002Fbin\u002Fvarlock load\n```\n\n### \"Schema validation failed\"\n\n```bash\n# Check which variables are missing\u002Finvalid\nvarlock load  # Shows detailed errors\n\n# Common fixes:\n# - Add missing required variables to .env\n# - Fix type mismatches (port must be number)\n# - Check string prefixes match schema\n```\n\n### \"Sensitive value exposed in logs\"\n\n```bash\n# 1. Rotate the exposed secret immediately\n# 2. Check .env.schema has @sensitive annotation\n# 3. Ensure using varlock commands, not echo\u002Fcat\n\n# Add missing sensitivity:\n# Before: API_KEY=\n# After:  # @type=string @sensitive\n#         API_KEY=\n```\n\n---\n\n## npm Scripts\n\nAdd these to your package.json:\n\n```json\n{\n  \"scripts\": {\n    \"env:validate\": \"varlock load\",\n    \"env:check\": \"varlock load --quiet || echo 'Environment validation failed'\",\n    \"prestart\": \"varlock load --quiet\",\n    \"start\": \"varlock run -- node server.js\"\n  }\n}\n```\n\n---\n\n## Security Checklist for New Projects\n\n- [ ] Install Varlock CLI\n- [ ] Create `.env.schema` with all variables defined\n- [ ] Mark all secrets with `@sensitive` annotation\n- [ ] Add `@defaultSensitive=true` to schema header\n- [ ] Add `.env` to `.gitignore`\n- [ ] Commit `.env.schema` to version control\n- [ ] Add `npm run env:validate` to CI\u002FCD\n- [ ] Document secret rotation procedure\n- [ ] Never use `cat .env` or `echo $SECRET` in Claude sessions\n\n---\n\n## Quick Reference Card\n\n| Task | Safe Command |\n|------|-------------|\n| Validate all env vars | `varlock load` |\n| Quiet validation | `varlock load --quiet` |\n| Run with env | `varlock run -- \u003Ccmd>` |\n| View schema | `cat .env.schema` |\n| Check specific var | `varlock load \\| grep VAR_NAME` |\n\n| Never Do | Why |\n|----------|-----|\n| `cat .env` | Exposes all secrets |\n| `echo $SECRET` | Exposes to Claude context |\n| `printenv \\| grep` | Exposes matching secrets |\n| Read .env with tools | Secrets in Claude's context |\n| Hardcode in commands | In shell history |\n\n---\n\n## Integration with Other Skills\n\n### Clerk Skill\n- Test user passwords are `@sensitive`\n- Test emails are `@sensitive=false` (contain +clerk_test, not secret)\n- See: `~\u002F.claude\u002Fskills\u002Fclerk\u002FSKILL.md`\n\n### Docker Skill\n- Mount `.env` file, never copy secrets to image\n- Use `varlock run` as entrypoint\n- See: `~\u002F.claude\u002Fskills\u002Fdocker\u002FSKILL.md`\n\n---\n\n*Last updated: December 22, 2025*\n*Secure-by-default environment management for Claude Code*\n",{"name":5,"risk":39,"source":45,"version":46,"description":7},"https:\u002F\u002Fgithub.com\u002Fdmno-dev\u002Fvarlock","1.0.0","main","a50a3aa6b39fb0e1b7db88bef1bfc9c93606e126","modules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fvarlock",0,"https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant","https:\u002F\u002Fgithub.com\u002FSam-06060","Mobile Application Developer | Kotlin | Flutter, KMP, Swfit, Android,Swift UI | Building at Saar It Resources | Creator of Jarvis (AI Assistant)","2026-06-23 05:13:38",{"source":8,"skillName":5,"commands":56,"prompt":66,"zipAvailable":67},[57,60,63],{"tool":58,"command":59},"npx","npx skills add Sam-06060\u002Fjarvis-assistant --skill varlock",{"tool":61,"command":62},"bunx","bunx skills add Sam-06060\u002Fjarvis-assistant --skill varlock",{"tool":64,"command":65},"pnpm","pnpm dlx skills add Sam-06060\u002Fjarvis-assistant --skill varlock","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fvarlock\u002FSKILL.md",true,[],[70,81,98,123,142,169],{"skillNo":71,"name":72,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":73,"categories":74,"keywords":78,"publishedAt":40},"01M6GDRVS6FXX3ESH0C9DW01C0","test_skill","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fscratch\u002Ftest_skill\u002FSKILL.md",[75],{"categoryNo":76,"categoryName":77,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",[79,80],"Test Skill","test",{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":40},"01M6GDRQ40HX22MA6XWC31RHHK","zustand-store-ts","Create Zustand stores following established patterns with proper TypeScript types and middleware.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzustand-store-ts\u002FSKILL.md",[],[88,89,90,91,92,93,94,95,96,97],"zustand store ts","zustand","store","with","types","middleware","patterns","community","create","typescript",{"skillNo":99,"name":100,"nameZh":6,"description":101,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":102,"categories":103,"keywords":107,"publishedAt":40},"01M6GDRKEA0WE670SPFWX5GKCN","zoom-automation","Automate Zoom meeting creation, management, recordings, webinars, and participant tracking via Rube MCP (Composio). Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoom-automation\u002FSKILL.md",[104],{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发",[108,109,110,111,112,113,114,115,116,117,39,118,119,120,95,121,36,122],"automation","zoom automation","zoom","first","Tools","search","MCP","via","meeting","automate","creation","webinars","composio","recordings","tracking",{"skillNo":124,"name":125,"nameZh":6,"description":126,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":127,"categories":128,"keywords":130,"publishedAt":40},"01M6GDRFS1452PC71JQ38S24HR","zoho-crm-automation","Automate Zoho CRM tasks via Rube MCP (Composio): create\u002Fupdate records, search contacts, manage leads, and convert leads. Always search tools first for current schemas.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzoho-crm-automation\u002FSKILL.md",[129],{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},[131,108,132,133,134,135,136,95,113,137,120,138,39,117,112,139,96,140,114,141],"crm automation","zoho crm","crm","zoho crm automation","zoho","leads","contacts","records","update","tasks","manage",{"skillNo":143,"name":144,"nameZh":6,"description":145,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":146,"categories":147,"keywords":151,"publishedAt":40},"01M6GDRCKQBAVTGHX5XBH26KPZ","zod-validation-expert","Expert in Zod — TypeScript-first schema validation. Covers parsing, custom errors, refinements, type inference, and integration with React Hook Form, Next.js, and tRPC.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzod-validation-expert\u002FSKILL.md",[148],{"categoryNo":149,"categoryName":150,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[152,153,154,155,156,97,157,158,159,160,161,162,91,163,164,165,166,95,167,168],"expert","zod","zod validation expert","validation","react","safe","parsing","errors","schema validation","react hook form","hook","trpc","form","type","next","schema","Next.js",{"skillNo":170,"name":171,"nameZh":6,"description":172,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":173,"categories":174,"keywords":176,"publishedAt":40},"01M6GDR658B08K4MY0RWD4A6EH","zeroize-audit","Detects missing zeroization of sensitive data in source code and identifies zeroization removed by compiler optimizations, with assembly-level analysis, and control-flow verification. Use for auditing C\u002FC++\u002FRust code handling secrets, keys, passwords, or other sensitive data.","https:\u002F\u002Fgithub.com\u002FSam-06060\u002Fjarvis-assistant\u002Fblob\u002Fmain\u002Fmodules\u002Fagent_skills\u002Fawesome-skills\u002Fplaybooks\u002Fzeroize-audit\u002FSKILL.md",[175],{"categoryNo":105,"categoryName":106,"taxonomyType":21,"taxonomyTypeDesc":22},[177,178,179,180,181,182,183,184,95,185,186,187,188,189,190,191,192,32,193,114],"zeroize audit","audit","write","passwords","get","project","c++","activate","assembly","read","Bash","secrets","analysis","data","flow","verification","rust"]