varlock

Redact sensitive credentials from code, logs, and outputs.

Updated Mar 20, 2026
One-click install
npx skills add https://github.com/sixscripts-ai/ghostssh --skill varlock-sixscripts-ai
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: varlock
Source: https://github.com/sixscripts-ai/ghostssh/tree/main/ghostssh-skills/varlock
Command: npx skills add https://github.com/sixscripts-ai/ghostssh --skill varlock-sixscripts-ai

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Redacts and prevents leakage of environment variables and credentials in code, logs, and outputs, ensuring sensitive values never appear in ghostssh sessions or in chat.

Core Features & Use Cases

  • Pattern-based detection of sensitive terms such as .env, API key, token, secret, MINIMAX_API_KEY, APPWRITE_API_KEY, MEM0_API_KEY, ANTHROPIC_API_KEY, and any sk-* / m0-* strings.
  • Automatic redaction of values and safe placeholders in outputs and logs.
  • Pre-commit and run-time guardrails to avoid exposing secrets during commits and interactive prompts.

Quick Start

Activate the varlock guard to automatically redact secrets before commits, logs, and outputs.

Frequently Asked Questions about varlock

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I prevent environment variables and API keys from leaking in logs?

Prevent secret leakage by using pattern-based detection to automatically redact environment variables and API keys from outputs and logs. It identifies sensitive terms like sk-* and m0-* strings, replacing real values with safe placeholders.

How do I redact secrets before committing code to avoid exposing credentials?

Redact secrets before committing by applying pre-commit guardrails that detect and mask sensitive credentials. It scans for patterns like MINIMAX_API_KEY and ANTHROPIC_API_KEY to ensure secrets stay out of commits.

What patterns are detected to redact credentials in code and outputs?

Detected patterns include .env, API keys, tokens, secrets, and specific strings like MINIMAX_API_KEY, APPWRITE_API_KEY, MEM0_API_KEY, ANTHROPIC_API_KEY, as well as any sk-* or m0-* strings for strict redaction.

Can I use automatic secret redaction for .env files and runtime messages?

Yes, you can use automatic secret redaction for .env files and runtime messages. It implements run-time guardrails to avoid exposing secrets during interactive prompts and keeps sensitive values out of outputs.

Does varlock work with Anthropic and Minimax API keys in ghostssh sessions?

Yes, it works with ANTHROPIC_API_KEY and MINIMAX_API_KEY in ghostssh sessions. It triggers whenever a potential secret is mentioned, redacting sensitive credentials to prevent exposure during interactive sessions.