varlock
Manages environment variables securely in Claude Code sessions, ensuring sensitive data remains protected and never exposed.
Install this skill
Security score
The varlock skill was audited on Jun 10, 2026 and we found 52 security issues across 4 threat categories, including 2 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 320 | API_KEY=exec('op read "op://vault/item/field"') |
Direct command execution function call
| 328 | DB_PASSWORD=exec('aws secretsmanager get-secret-value --secret-id prod/db') |
Template literal with variable interpolation in command context
| 237 | ```yaml |
Template literal with variable interpolation in command context
| 333 | ```bash |
Curl to non-GitHub URL
| 76 | curl -H "Authorization: Bearer sk_live_xxx" https://api.example.com |
Curl to non-GitHub URL
| 79 | curl -H "Authorization: Bearer $API_KEY" https://api.example.com |
Curl to non-GitHub URL
| 93 | curl -sSfL https://varlock.dev/install.sh -o "$tmpdir/varlock-install.sh" |
Curl to non-GitHub URL
| 251 | && curl -sSfL https://varlock.dev/install.sh -o "$tmpdir/varlock-install.sh" \ |
Access to hidden dotfiles in home directory
| 97 | # Add to PATH (add to ~/.zshrc or ~/.bashrc) |
Access to hidden dotfiles in home directory
| 347 | ls ~/.varlock/bin/varlock |
Access to hidden dotfiles in home directory
| 353 | ~/.varlock/bin/varlock load |
Access to hidden dotfiles in home directory
| 439 | - See: `~/.claude/skills/clerk/SKILL.md` |
Access to hidden dotfiles in home directory
| 444 | - See: `~/.claude/skills/docker/SKILL.md` |
Access to root home directory
| 255 | && ln -s /root/.varlock/bin/varlock /usr/local/bin/varlock |
Access to .env file
| 19 | - You want a secure-by-default workflow built around Varlock instead of direct `.env` inspection. |
Access to .env file
| 41 | cat .env | grep SECRET |
Access to .env file
| 48 | ### Rule 2: Never Read .env Directly |
Access to .env file
| 52 | cat .env |
Access to .env file
| 53 | less .env |
Access to .env file
| 54 | Read tool on .env file |
Access to .env file
| 57 | cat .env.schema |
Access to .env file
| 107 | # Create .env.schema from existing .env |
Access to .env file
| 111 | touch .env.schema |
Access to .env file
| 116 | ## Schema File: .env.schema |
Access to .env file
| 200 | cat .env.schema |
Access to .env file
| 203 | grep "^[A-Z]" .env.schema |
Access to .env file
| 227 | # 2. Update .env file manually (don't use Claude for this) |
Access to .env file
| 294 | 1. Update the value in your .env file manually |
Access to .env file
| 298 | I can help you update the .env.schema if you need to add new variables." |
Access to .env file
| 301 | ### When User Asks to "Show me the .env file" |
Access to .env file
| 305 | "I won't read .env files directly as they contain secrets. Instead: |
Access to .env file
| 307 | - Run `cat .env.schema` to see the schema (safe) |
Access to .env file
| 308 | - I can help you modify .env.schema if needed" |
Access to .env file
| 318 | # In .env.schema |
Access to .env file
| 326 | # In .env.schema |
Access to .env file
| 334 | # In .env.schema |
Access to .env file
| 363 | # - Add missing required variables to .env |
Access to .env file
| 372 | # 2. Check .env.schema has @sensitive annotation |
Access to .env file
| 403 | - [ ] Create `.env.schema` with all variables defined |
Access to .env file
| 406 | - [ ] Add `.env` to `.gitignore` |
Access to .env file
| 407 | - [ ] Commit `.env.schema` to version control |
Access to .env file
| 410 | - [ ] Never use `cat .env` or `echo $SECRET` in Claude sessions |
Access to .env file
| 421 | | View schema | `cat .env.schema` | |
Access to .env file
| 426 | | `cat .env` | Exposes all secrets | |
Access to .env file
| 429 | | Read .env with tools | Secrets in Claude's context | |
Access to .env file
| 442 | - Mount `.env` file, never copy secrets to image |
External URL reference
| 14 | > **Documentation**: https://varlock.dev |
External URL reference
| 76 | curl -H "Authorization: Bearer sk_live_xxx" https://api.example.com |
External URL reference
| 79 | curl -H "Authorization: Bearer $API_KEY" https://api.example.com |
External URL reference
| 93 | curl -sSfL https://varlock.dev/install.sh -o "$tmpdir/varlock-install.sh" |
External URL reference
| 251 | && curl -sSfL https://varlock.dev/install.sh -o "$tmpdir/varlock-install.sh" \ |
External URL reference
| 336 | API_URL=env('API_URL_${NODE_ENV}', 'http://localhost:3000') |