Audits environment variable management across eight dimensions including secret exposure and startup validation.
npx skills add https://github.com/greglas75/zuvo --skill env-audit-greglas75
Please help me install this Agent Skill. Skill: env-audit Source: https://github.com/greglas75/zuvo/tree/main/skills/env-audit Command: npx skills add https://github.com/greglas75/zuvo --skill env-audit-greglas75
High-intent search queries and answers about installing and using this skill.
Run the env-audit skill against your project root. It scans process.env usage, compares variables against .env.example, checks for startup validation libraries like Zod or envalid, and reports a score with severity-ranked findings.
The audit's ENV4 dimension checks .gitignore coverage, runs git ls-files for committed .env files, searches for hardcoded API keys and tokens, and flags NEXT_PUBLIC_ or VITE_ variables containing secrets. Any committed secret triggers a critical gate failure.
Yes. It auto-detects the stack from files like requirements.txt, pyproject.toml, next.config, and vite.config, then searches the matching access patterns such as os.environ, os.getenv, import.meta.env, and NEXT_PUBLIC_ variables.
Yes. Pass the --secrets-only flag to run only the ENV4 secret exposure dimension, or use --parity to run only ENV5 environment parity. You can also scope the audit to a subdirectory for monorepo packages.
Do not use it for general source-code secret scanning (use a security audit instead), CI pipeline configuration review, or infrastructure auditing. It focuses specifically on env var definition, usage, validation, and documentation.
ZaxbyHubAudit environment variable contracts across backend settings, Docker, Compose, CI, and documentation.
hamzaPixlAudit API endpoints for naming, response shape, validation, and authentication issues.
DonTiziScan codebases for secrets, OWASP risks, and vulnerable dependencies.
addxaiDetect leaked credentials in local Git history and remote repositories with TruffleHog CLI.
