Envilder — скилл

---
name: envilder
description: >-
  Integrate Envilder into an application: map its environment variables to
  AWS SSM Parameter Store or Azure Key Vault secrets in a versioned
  envilder.json, validate the map file, and use that one contract for local
  development (envilder exec or pull), GitHub Actions
  (macalbert/envilder/github-action) and runtime SDKs (.NET, Python, Node.js).
  Use when the user mentions Envilder or envilder.json, or wants to move .env
  files or hardcoded secrets to AWS SSM or Azure Key Vault, or load cloud
  secrets in CI or at runtime. Never reads or prints secret values.
license: MIT
compatibility: >-
  Needs Node.js 22.12+ to run the envilder CLI with npx. Commands that call
  AWS or Azure need the user's cloud credentials.
metadata:
  homepage: https://envilder.com
  repository: https://github.com/macalbert/envilder
---

# Envilder

Envilder keeps **one versioned secret contract across local development,
CI/CD and runtime**: `envilder.json` maps each environment variable name to a
secret identifier in AWS SSM Parameter Store or Azure Key Vault. The file holds
names and paths, never values, so it is committed and reviewed like code. The
cloud provider stays the source of truth.

Use the existing Envilder CLI, GitHub Action and SDKs. Do not write custom
secret-loading code, and do not add Envilder features to the user's project.

## Safety rules (always)

1. **Never read, print, log, commit or invent a secret value.** When you need
   the variables of a `.env` file, read only the names, for example
   `grep -oE '^[[:space:]]*(export[[:space:]]+)?[A-Za-z_][A-Za-z0-9_./-]*=' .env`.
   Do not `cat` a `.env` file or a secret-bearing config file.
2. **Classify every Envilder command before running it** and ask for explicit
   approval for anything above "offline":

   | Class | Commands | Run it? |
   |-------|----------|---------|
   | Offline | `envilder --version`, `--help`, `envilder validate --offline` with the CLI the project already installs (`npx --no envilder ...`, `pnpm exec envilder ...`) | Yes |
   | Downloads and runs the CLI | Any `npx envilder ...` when the project does not install `envilder` (npx fetches the package and runs it with access to the workspace and environment) | Ask first, or propose adding `envilder` as a dev dependency |
   | Checks existence (calls the provider, reads no value) | `npx envilder validate` | Ask first: it uses the user's credentials and prints the cloud identity |
   | Reads values | `npx envilder` (pull to `.env`), `envilder exec`, `validate --compare-values`, running code that calls an SDK `load`/`resolve` | Only when the user explicitly asks for that run |
   | Writes secrets | `envilder --push`, single-secret push (`--key`/`--value`/`--secret-path`) | Never run it yourself. Give the user the command to run |