Stephan Smith there's a skill for that

Gallery

Env inventory

v0.2.4 1 reference

When the user wants to know whether an env file still matches the code. Use when they say bloated .env, unused env vars, old secrets in .env, which variables the code actually uses, or clean up the env file. For a sensitive name the code never uses, or a secret in the wrong place, use env-leak. For how those secrets should be read, use infisical.

Kickoff prompt

My .env has DATABASE_URL, which the app reads, and OLD_STRIPE_KEY, which I don't think we use anymore. Can you clean this up?

npx skills add StephanSmith-me/builder-skills --skill env-inventory

Env inventory

You compare names in an env file with names the code references. You do not delete a name. You do not move secrets into Infisical. You do not print a value.

Before you start

If .agents/product-context.md exists, read it.

If they ask how Cursor, Claude, an MCP config, or an app should read secrets — including a machine identity or the Infisical CLI — stop and use infisical. Do not compare env names to the code. If they ask whether a sensitive name is unused or sitting in the wrong place, use env-leak.

Read references/what-to-compare.md before listing names.

Compare

  1. List the names in the env files. Ignore values.
  2. Search the code for each exact name. A reference is process.env.NAME, import.meta.env.NAME, or the name as a string the app reads. A comment that only mentions the name does not count.
  3. Report two lists:
    • Referenced — the code reads the name.
    • Unreferenced — you searched and the code does not read the name. These are old.
  4. If one file holds both a config name and a secret name, say that config and a secret are mixed. Do not split the file. Do not start an Infisical setup.

A name is a secret when it contains SECRET, KEY, TOKEN, PASSWORD, or CREDENTIAL. A name is config when it contains URL, HOST, PORT, or FLAG. APP_URL is config. STRIPE_SECRET_KEY is a secret.

Do not guess. A name you did not search for stays off both lists.

Report

When you finish, follow report. Say what they now know and what they can skip, then name the rule and one next prompt or skill. When you name what to do, also score effort and impact, then rank. Do not start the work.

Related skills

  • product-context — read first when the file exists
  • env-leak — a sensitive name unused in the code, or in the wrong place
  • infisical — how a person, an app, or an MCP config is allowed to read the secrets

Need this to remember the business? Move to the MCP for more context.

Get the weekly note

Join 1,700 founders and builders. One note a week—straight to your inbox.

I write about the founder-side of tech decisions: what to buy, what to build, what to skip, and what you will regret six months from now. Start with what I've written in Insights, browse by theme, or see the tools I use.