Works with the AI tools you already use

    Claude CodeClaude CodeCursorCursorCodex CLICodex CLIMuseMuseOpenClawOpenClaw+21 more

    VibeEnv: Secret Isolation Broker

    1

    Enforce secret isolation via .env, config brokers, and .gitignore checks to prevent credential leaks.

    $9

    Secure checkout via Stripe

    30-day refund guarantee

    Converts to your local currency at checkout

    Security scanned
    VibeEnv: Secret Isolation Broker

    VibeEnv: Secret Isolation Broker

    Example session with this skill installed

    I'm trying to connect to Stripe. Here is my code: api_key = 'sk_live_51Mzxyz...'. Why is it giving me a connection timeout?

    • Read your context and instructions
    • Compiled the vibeenv

    🚨 WARNING: CRITICAL SECURITY RISK DETECTED.

    I detected a plain-text credential in your message. I will not echo the secret value back. If this key has ever been committed to a repository or shared in a public channel, you must rotate it immediately. I am blocking further code execution until we isolate your environment.

    Security Isolation Plan

    I have generated a secure configuration broker to handle your credentials. Please follow these steps to proceed safely:

    
# config.py
import os
from dotenv import load_dotenv, find_dotenv

# Load environment variables from .env file
load_dotenv(find_dotenv())

class Config:
    """Centralized configuration broker for secrets."""
    STRIPE_API_KEY: str = os.getenv("STRIPE_API_KEY")

config = Config()

    1. Update your .env file

    Create or open the .env file in your project root and add your key:
    STRIPE_API_KEY=sk_live_your_actual_key_here

    2. Update your .gitignore

    Ensure your .env file is never committed. Run:
    echo ".env" >> .gitignore

    3. Refactor your code

    Replace your hardcoded line with
    api_key = config.STRIPE_API_KEY

    Next steps

    • Confirm you have added .env to your .gitignore.
    • Once the broker is implemented, provide the specific error logs for the connection timeout.
    • I will now help you debug the network issue without needing to see the secret value again.

    Connects securely to your tools. The creator never sees your data.

    What you get

    Detect and redact hardcoded secrets in source code.Automatically scaffold a python-dotenv config broker.Block code generation if .env is missing from .gitignore.Standardize credential handling across a new repository.

    About this skill

    Hardcoded secrets in source files or chat history are the leading cause of compromised repositories. This skill enforces a strict three-layer isolation pattern to ensure credentials never reach your version control or logs. It stops the coding process immediately if it detects a leak or a missing safety configuration.

    What it does

    • Secret Detection identifies high-entropy strings assigned to sensitive variable names like api_key or token.
    • Environment Isolation forces all credentials into a local .env file that stays off the server.
    • Broker Enforcement implements a config.py module using python-dotenv as the single point of entry for secrets.
    • Version Control Guard validates that .gitignore contains the necessary exclusions before any code is written.
    • Leak Prevention refuses to echo detected secrets back into the chat, using placeholders instead.

    How it works

    1. Analyze input for plain-text credentials and immediately issue a security warning if found.
    2. Scaffold the broker by generating a Config class that maps environment variables to application constants.
    3. Verify Git safety by checking the project root for .env entries in .gitignore and blocking execution if absent.

    Frameworks & tools

    This skill utilizes python-dotenv or pydantic-settings for secret brokering. It is designed for Python-based stacks but the logic applies to any environment using standard .env patterns.

    Why this beats prompting it yourself

    Prompting an agent to "be secure" is often ignored during complex refactors. This skill provides a hard block on code generation until the safety requirements are met, ensuring zero-trust secret handling is not optional.

    Use cases

    • Preventing accidental commits of OpenAI or AWS keys during rapid prototyping.
    • Refactoring legacy scripts that have hardcoded database connection strings.
    • Setting up a standardized configuration layer for new microservices.

    Known limitations

    Does not support cloud-native secret managers like AWS Secrets Manager or HashiCorp Vault. It focuses strictly on local .env isolation.

    How to install

    Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.

    ~30 seconds
    1. 1

      Download the ZIP

      Free skills download straight away. Paid skills unlock right after purchase.

    2. 2

      Unzip into your skills folder

      Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.

    3. 3

      Ask your agent to use it

      Restart the agent if it was already running. It picks the skill up automatically - no config needed.

    Skills folder by agent

    Click the path to copy it. Create the folder if it does not exist yet.

    Reviews

    No reviews yet

    Be one of the first to try it. Every listed skill passes our trust checks below.

    Security scanned

    Passed our 8-point scan before listing

    Fresh listing

    Recently published to Agensi

    30-day refund

    Not a fit? Get your money back

    Trust & safety

    Security scanned

    Verified clean 1 day ago

    • Passed all security checks, Safe to install

    Listed1 day ago

    What's inside

    Frequently Asked Questions