Varlock skill
A skill and CLI around .env.schema: the agent sees variable names, types and rules while secret values never reach its context
- 4,820 ★ on the repository
- Last commit
- MIT
Extended access
Why this level
- Varlock reads .env files and pulls values from secret managers like 1Password and AWS
- The skill protects with instructions rather than isolation: an agent with shell access can technically read secrets
Install
- Works in
In your terminal, with SkillFoxx CLI
npx skillfoxx add skills/varlockDetects the agents on your machine, shows the access level and pins the version.
Other ways to install
Access and checks
How we reviewExtended accessThe tool runs code or makes network calls and only reads external data.
- Varlock reads .env files and pulls values from secret managers like 1Password and AWS
- The skill protects with instructions rather than isolation: an agent with shell access can technically read secrets
This is third-party code. Review the repository files before installing.
What it does
Varlock replaces .env.example with a .env.schema file whose decorator comments describe the type, requirement, sensitivity and docs of each variable. The schema is safe to commit and for an agent to read. The skill in skills/varlock teaches the agent not to print secrets: instead of cat .env it calls varlock load --agent, which prints JSON with sensitive values masked. varlock run -- python script.py passes resolved variables to a process, and varlock scan with git hooks hunts for leaks in AI-generated code. Plugins pull values from 1Password, Infisical, AWS, Azure, GCP and HCP Vault.
Who it is for. For developers who give Claude Code or Cursor access to a project with API keys and do not want secrets to land in the model's context.
Good fit when
- The project has a .env with keys and the agent must work with configuration without reading values
- You want one variable schema instead of a drifting .env.example
- You want to check AI-written code for secret leaks with varlock scan and git hooks
- Secrets sit in 1Password or AWS and the agent only needs the schema
- You need types for env.d.ts and validation of ports, URLs and enums
Not a fit when
- The project uses no environment variables or secrets
- You need an encrypted secret store: Varlock takes values from external backends
- The team will not maintain .env.schema in the repository
- You need protection from an agent with shell access: the skill relies on rules, not isolation
Example request
Add STRIPE_API_KEY to .env.schema as required and sensitive and check the configuration with varlock loadLimitations
The skill is a set of rules for the agent: nothing stops a model with shell access from reading .env directly if it ignores the instruction. Varlock must be installed separately: the CLI comes through npx, Homebrew, a script or Docker. Secret store plugins need their own tokens and accounts. When Varlock is a package.json dependency, commands run through the package manager, for example npm exec varlock load.
How to disable. Delete the skill folder from the agent's skills directory and the package with npm uninstall varlock or brew uninstall varlock. You can keep .env.schema as variable documentation.
FAQ
Why is .env.schema better than .env.example?
The schema holds types, requirements, sensitivity and descriptions, so it is a single source that cannot drift from the code. TypeScript types can be generated from it.
How does Varlock hide secrets from the agent?
varlock load --agent prints JSON with sensitive values masked. The skill forbids the agent from running cat .env, echo $SECRET and printenv.
How do I install Varlock?
In a JavaScript project run npx varlock init. A standalone binary installs through brew install dmno-dev/tap/varlock or curl with varlock.dev/install.sh, and the Docker image is ghcr.io/dmno-dev/varlock.
Where does Varlock get secret values?
From local .env.local files or the environment, and plugins connect 1Password, Infisical, AWS, Azure, GCP, HCP Vault and Bitwarden.
What does varlock scan do?
It looks for leaked secrets in code, including AI-written code, and works with git hooks.
Discussion
No questions or reviews yet.
Related
SkillsVarlock Skill
Varlock Skill for Claude Code
A Claude Code skill that keeps .env secrets out of the agent's context: validation and runs through Varlock with masked values
VibeSec
VibeSec-Skill
A secure coding skill: the agent looks at code from a bug hunter's perspective and prevents common web vulnerabilities
A security scanner for agent skills: finds prompt injection, data exfiltration and malicious code before you install
Security scanner for agent skills and MCP servers: finds prompt injection, data exfiltration and supply chain risks before install
A code security audit skill by Cloudflare: the agent runs recon, coverage-led hunting and independent verification of findings, then produces a structured repor
A skill that audits vibe-coded apps: secrets, Supabase RLS, authorization, payments, rate limits, mobile and AI integrations
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Repository stars | Main difference |
|---|---|---|---|
| Varlock (this entry) | no | 4,820 | |
| Varlock Skill | no | 33 | A third-party skill for Claude Code, while this is the skill and CLI from Varlock's own authors |
| 2password | no | 305 | a wrapper over the 1Password CLI |
README in short
The description presents Varlock as an AI-safe way to manage .env: schemas for agents, secrets for humans. The feature list covers type checks, leak scanning, log redaction and multiple environments. Examples of a schema with decorators follow, then installation, the load and run workflow, an AI-safe config section and the list of published packages: core, plugins, a VS Code extension and a Docker image.
README badge
Original SKILL.md
--- name: varlock description: >- Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminal, logs, or LLM context. Provides guidance around integrating varlock into a project, reading/editing .env.schema and other .env files, using the varlock CLI, adding plugins and framework integrations. Trigger phrases include "environment variable", "env var", "secrets", ".env", "API key", "credentials", "sensitive", "varlock" --- # Varlock This skill helps securely manage env vars and secrets in your project using varlock. > **Docs**: https://varlock.dev > **Repo**: https://github.com/dmno-dev/varlock Varlock uses `.env.schema` (instead of `.env.example`) to provide a single source of truth for your project's env vars. Schema info is expressed using `@decorator` style comments. Sensitive values can be set in git-ignored `.env.local` files, passed in via the environment, or use functions to load from secure backends like 1Password, Vault, AWS, etc. Basic `.env.schema` example: ```env-spec # @defaultSensitive=false @defaultRequired=infer # @currentEnv=$APP_ENV # @generateTsTypes(path=env.d.ts) # --- # @type=enum(dev, staging, prod) APP_ENV=dev # @type=url API_URL=https://api.example.com # Description of this var # @sensitive @required @type=string(startsWith=sk-) # @docs(https://xyzapi.com/docs/auth) XYZ_API_KEY= ``` Your `.env.schema` is committed to version control and safe for agents to read and update. The `varlock` CLI helps load and validate env vars while masking anything sensitive, and can securely inject env vars into commands. **NOTE:** If varlock is installed locally via `package.json` (not as a standalone binary), invoke it via your package manager — e.g., `pnpm exec varlock load`, `bunx varlock load`, `npm exec varlock load`. Check the project's package manager before running CLI commands. ## CRITICAL: Security rules These rules are non-negotiable: ### Do not expose secrets ```bash # NEVER do these - exposes secrets to agent context cat .env cat .env.local echo $SECRET_KEY printenv | grep API # SAFE alternatives varlock load --agent # JSON output, sensitive values redacted varlock load # human-readable, sensitive values masked