SkillFoxx

Envilder skill

A skill that teaches an agent to wire up Envilder: one envilder.json maps env variables to AWS SSM or Azure Key Vault secrets.

  • 138 ★ on the repository
  • Last commit
  • MIT
Skill

Extended access

Why this level

  • The agent runs the Envilder CLI, which with certain commands calls AWS or Azure using the user credentials.
  • The skill runs commands that read or write secret values only on a direct request.
All reasons and checks

macalbert/envilderAuthor:macalbert

Install

In your terminal, with SkillFoxx CLI

npx skillfoxx add skills/envilder

Detects the agents on your machine, shows the access level and pins the version.

Other ways to install

Access and checks

How we review

Extended accessThe tool runs code or makes network calls and only reads external data.

  • The agent runs the Envilder CLI, which with certain commands calls AWS or Azure using the user credentials.
  • The skill runs commands that read or write secret values only on a direct request.

This is third-party code. Review the repository files before installing.

What it does

The `envilder` skill walks an agent through adding Envilder to an existing project. The agent lists the variables the application reads, picks AWS SSM or Azure Key Vault, writes `envilder.json` and checks it with `envilder validate --offline`. The file holds names and paths rather than values, so it is committed and reviewed like code. The skill then wires the same file into local runs through `envilder exec`, into GitHub Actions with OIDC sign-in and, only when nothing else works, into the .NET, Python or Node.js SDK. The agent does not run commands that read or write secret values without a direct request.

Who it is for. Teams that keep secrets in AWS SSM or Azure Key Vault and want to drop key sharing and passed-around `.env` files from onboarding.

Good fit when

  • A new developer loses time hunting for keys while the `.env` file circulates through wikis and chats.
  • A GitHub Actions workflow passes `secrets.DATABASE_URL` to tests, and the secrets should move to AWS SSM with OIDC sign-in.
  • A `.env` with five variables must become a secret map without showing the values.
  • `envilder validate` fails on the map file, and the agent must find the cause and fix it.

Not a fit when

  • Secrets live outside AWS SSM and Azure Key Vault: the skill supports no other stores.
  • The job is a single one-off `.env` with no CI and no shared contract.
  • You need Envilder features missing from the installed version: the skill does not emulate them with custom code.

Example request

Add Envilder to this ASP.NET API: it reads `ConnectionStrings:Orders` and `Payments:ApiKey`, and the parameters live in SSM under `/orders-api/dev/`.

Limitations

The skill only configures Envilder and does not replace it: it needs Node.js 22.12 or newer to run the CLI through `npx`, and the user supplies AWS or Azure access. The `npx envilder` command downloads the package and runs it with access to the workspace, so the agent first suggests adding the package to devDependencies. `gh skill install` is in public preview and needs GitHub CLI 2.90 or newer. Secret writes with `--push` stay with the user: the agent gives the command and does not run it.

How to disable. Delete the `envilder` folder from the agent skills directory, for example `.claude/skills/` or `~/.claude/skills/`. `envilder.json` and CI wiring stay, remove them separately.

FAQ

How do I install the Envilder skill in Claude Code?

Run `gh skill install macalbert/envilder envilder --agent claude-code`. For Codex switch the agent to `codex` and add `--scope user`; a generic option is `npx skills add macalbert/envilder --skill envilder`.

Does the skill read secret values?

Not without an explicit request. From `.env` the agent takes variable names only, and it runs pull, `exec` and `validate --compare-values` on a direct request.

How do I call the skill manually?

In Claude Code type `/envilder`. Elsewhere it loads on its own when a request mentions Envilder, `envilder.json` or moving secrets to AWS SSM or Azure Key Vault.

Is an SDK required?

Usually not. The skill uses the CLI and the GitHub Action, and picks the .NET, Python or Node.js SDK only when injecting secrets at startup is not enough.

Which secret stores does Envilder support?

AWS SSM Parameter Store and Azure Key Vault. The agent picks the provider from what the project already uses: AWS CDK and AWS credentials point to the first, Azure resources and `azure/login` to the second.

Discussion

No questions or reviews yet.

Skills
Editors’ pick

Microsoft Learn skills for nearly every Azure service: limits, configuration, security, architecture and troubleshooting with doc links

SkillExtended access813

Skill that deploys a Dirextalk message server on AWS with a domain and wires the local agent room through the Matrix bridge.

SkillBroad access457
Official

A Claude Code skill that rolls out AEnvironment platform environments as temporary instances or permanent services

SkillBroad access323

A collection of Copilot skills and agents for Azure, API Management, Terraform and diagrams, installed via the skills CLI or APM

SkillExtended access206

A large base of DevOps, security, infrastructure and compliance skills for AI agents

SkillMinimal access1.2K
Editors’ pick

Isolated Linux microVMs for agent code: the official Vercel skill on the SDK, network rules and snapshots.

SkillExtended access224

README in short

Next to Envilder itself the repository ships a skill for its users, while the skills in `.github/skills/` are for the project contributors. The description lists six workflows, three install paths and example requests.

README badge

Original SKILL.md

---
name: envilder
description: >-
  Integrate Envilder into an application: map its environment variables to
  AWS SSM Parameter Store or Azure Key Vault secrets in a versioned
  envilder.json, validate the map file, and use that one contract for local
  development (envilder exec or pull), GitHub Actions
  (macalbert/envilder/github-action) and runtime SDKs (.NET, Python, Node.js).
  Use when the user mentions Envilder or envilder.json, or wants to move .env
  files or hardcoded secrets to AWS SSM or Azure Key Vault, or load cloud
  secrets in CI or at runtime. Never reads or prints secret values.
license: MIT
compatibility: >-
  Needs Node.js 22.12+ to run the envilder CLI with npx. Commands that call
  AWS or Azure need the user's cloud credentials.
metadata:
  homepage: https://envilder.com
  repository: https://github.com/macalbert/envilder
---

# Envilder

Envilder keeps **one versioned secret contract across local development,
CI/CD and runtime**: `envilder.json` maps each environment variable name to a
secret identifier in AWS SSM Parameter Store or Azure Key Vault. The file holds
names and paths, never values, so it is committed and reviewed like code. The
cloud provider stays the source of truth.

Use the existing Envilder CLI, GitHub Action and SDKs. Do not write custom
secret-loading code, and do not add Envilder features to the user's project.

## Safety rules (always)

1. **Never read, print, log, commit or invent a secret value.** When you need
   the variables of a `.env` file, read only the names, for example
   `grep -oE '^[[:space:]]*(export[[:space:]]+)?[A-Za-z_][A-Za-z0-9_./-]*=' .env`.
   Do not `cat` a `.env` file or a secret-bearing config file.
2. **Classify every Envilder command before running it** and ask for explicit
   approval for anything above "offline":

   | Class | Commands | Run it? |
   |-------|----------|---------|
   | Offline | `envilder --version`, `--help`, `envilder validate --offline` with the CLI the project already installs (`npx --no envilder ...`, `pnpm exec envilder ...`) | Yes |
   | Downloads and runs the CLI | Any `npx envilder ...` when the project does not install `envilder` (npx fetches the package and runs it with access to the workspace and environment) | Ask first, or propose adding `envilder` as a dev dependency |
   | Checks existence (calls the provider, reads no value) | `npx envilder validate` | Ask first: it uses the user's credentials and prints the cloud identity |
   | Reads values | `npx envilder` (pull to `.env`), `envilder exec`, `validate --compare-values`, running code that calls an SDK `load`/`resolve` | Only when the user explicitly asks for that run |
   | Writes secrets | `envilder --push`, single-secret push (`--key`/`--value`/`--secret-path`) | Never run it yourself. Give the user the command to run |

Report a problem