Env Config Audit

Audit the dotenv hygiene of a project directory the user owns or is authorized to inspect, using the bundled scripts/audit.js, and turn the JSON report into a concrete fix list.

• Only scan paths the user supplied or confirms they are authorized to inspect. If authorization is unclear, ask before running anything.
• The scanner is static: it reads .env* and .gitignore files and checks configuration hygiene. It never executes code and never follows symlinks. It skips .git/ and node_modules/ — vendored env files are out of the repo owner's control.
• This is not a secret-pattern scanner — it does not look for leaked credential values (that is what secret-leak-scan is for). It checks the hygiene around env files: ignore coverage, placeholders, duplicates, parity.
• Never print, recover, or reuse an env value. Findings report only key names, files, and lines — keep it that way when presenting results.
• The .gitignore check is a heuristic: it evaluates .gitignore files inside the scanned tree only (nested ones included), not .git/info/exclude, core.excludesFile, or ignores above the scan root. A fail means "not covered by any rule found here" — verify before claiming a real exposure.
• Do not overclaim. Zero findings means these checks passed — it does not prove the tree has no env problems.

Requires Node 18 or later. The script is bundled with this skill and has zero dependencies:

• Stdout is the JSON report (safe to pipe to a file); diagnostics go to stderr.
• Exit codes: 0 no findings, 1 findings present, 2 usage/read error.