Env2hell — AI skill for Claude Code

env2hell

An assistant runs an ordinary command like `env` — and every key and token you have is printed straight into the session, in plain text. Anyone with access to that conversation can read them. And it does not go away: the session is saved as a file on disk, indexed by memory tools, rolled into overnight digests. That is how keys leak.

env2hell denies those commands and gives the assistant a safe replacement. Works with Claude Code, Opencode and Codex, on Linux, macOS and Windows.

[Русская версия](README.RU.md)

Why

An app fails with an authorisation error. The developer asks the assistant to work out why the 401. It starts with the sensible thing — checking whether the key is set at all:

env | grep -i api

The check was right. But `grep` filters *lines*, and a line is `NAME=value`, so along with the answer "yes, it is set" the value itself is printed into the session. `cat .env` while looking at configuration ends the same way, and so does a plain `env` when comparing a local run against CI.

From there the line has a life of its own: the session is saved as a file on disk (Claude Code writes `.jsonl`), memory tools index it, digests are written overnight. One command like that costs a rotation of every key on the machine.

This is not hypothetical. It is where this repository came from: five tokens (Z.ai, DeepSeek, OpenRouter, Tavily, plus the assistant's own auth token) printed in full by a single command, in a session whose whole purpose was to name a model version.

Telling the model "don't do that" does not hold. Instructions are advice; this is a gate.

What you get

Command	Purpose
secrets-guard	Denies a command before it runs. Assistants call it automatically.
secrets-redact	Masks a secret a command printed, before the model reads it.
safe-env	Prints the environment with secret values masked. What the model uses instead.

Plus a rule file (`rules/secrets-hygiene.md`) installed into each