output-credentials-env-vars

Resolve credential: references into environment variables at worker startup.

430|12|Updated Mar 13, 2026

Search Tags:#credentials #env-vars #secret-management #credential-convention #startup-resolution #llm-keys

Ready to run

npx skills add https://github.com/growthxai/output --skill output-credentials-env-vars

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: output-credentials-env-vars
Source: https://github.com/growthxai/output/tree/main/coding_assistants/claude/plugins/outputai/skills/output-credentials-env-vars
Command: npx skills add https://github.com/growthxai/output --skill output-credentials-env-vars

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Wire encrypted credentials to environment variables at runtime to keep secrets out of code and config, while enabling seamless startup resolution.

Core Features & Use Cases

Credential-based env resolution: Any env var value starting with credential: is decrypted and injected into process.env during worker startup.
Migration and best-practices: Replaces plaintext .env secrets with encrypted credentials without breaking existing workflows.
Flexible mapping and documentation: Supports config/credentials.yml.enc and an optional _env section to document intended env mappings.
Security-first workflow: Keeps real secrets out of source, logs, and code, with deterministic startup behavior and clear traceability.

Quick Start

Initialize credentials and start the worker to automatically resolve credential: references into environment variables at startup.

Frequently Asked Questions about output-credentials-env-vars

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set environment variables from encrypted credentials at worker startup?▼

Use the credential: convention to resolve encrypted credentials into environment variables at worker startup. The startup resolver decrypts values from config/credentials.yml.enc and injects them into process.env, replacing credential: references with real values.

Can I migrate plaintext .env secrets to encrypted credentials without breaking existing workflows?▼

Yes, you can migrate plaintext .env secrets to encrypted credentials seamlessly. Replace plaintext values with credential: references in your environment configuration, and the startup resolver decrypts and injects them at runtime while preserving existing non-credential env vars.

How does the credential: convention work for LLM API keys like ANTHROPIC_API_KEY?▼

The credential: convention prefixes any env var value sourced from encrypted credentials. At worker startup, the resolver decrypts the corresponding entry from config/credentials.yml.enc and replaces the credential: reference with the actual API key value in process.env.

Does this approach support documenting intended environment variable mappings?▼

Yes, you can use the optional _env section within config/credentials.yml.enc to document intended environment variable mappings. This provides clear traceability for which encrypted credentials map to which env vars across development, testing, and production workflows.

What is the best way to keep secrets out of source code and logs?▼

Wire encrypted credentials to environment variables using config/credentials.yml.enc and the credential: convention. Real secrets stay out of source, logs, and code, with deterministic startup behavior that decrypts values only at runtime.