wrsmith108

Varlock Claude Skill — Git skill for Claude Code

Git community intermediate

Secure environment variable management ensuring secrets never appear in Claude sessions, terminals, logs, or git commits.

How to install Varlock Claude Skill

This entry records only its repository, not the path inside it, so there is no exact command to give. Open wrsmith108/varlock-claude-skill and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Varlock Claude Skill does

Secure-by-default environment variable management. Ensures secrets are **never exposed** in Claude sessions.

Alternatives in Git

Bulletproof Quick Start Guide — Target Audience: Complete beginners Never used Python/git before 11.1k ★
Local Review — You are tasked with setting up a local review environment for a colleague's branch 10k ★
Contributing To Ctf-skills — Thanks for helping expand the CTF skills collection 820 ★

README

Varlock Skill for Claude Code

Secure-by-default environment variable management. Ensures secrets are **never exposed** in Claude sessions.

Why This Skill?

When working with Claude Code, secrets can accidentally leak into:

Terminal output
Claude's input/output context
Log files or traces
Git commits or diffs

This skill wraps [Varlock](https://varlock.dev) to enforce secure patterns and prevent accidental exposure.

Installation

Option A: One-liner (Recommended)

mkdir -p ~/.claude/skills/varlock && curl -sSL https://raw.githubusercontent.com/wrsmith108/varlock-claude-skill/main/skills/varlock/SKILL.md -o ~/.claude/skills/varlock/SKILL.md

Option B: Manual

git clone https://github.com/wrsmith108/varlock-claude-skill /tmp/varlock-skill
cp -r /tmp/varlock-skill/skills/varlock ~/.claude/skills/
rm -rf /tmp/varlock-skill

Prerequisites

Install the Varlock CLI:

curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew
export PATH="$HOME/.varlock/bin:$PATH"

Core Principle

**Secrets must NEVER appear in Claude's context.**

Never Do	Safe Alternative
`cat .env`	`cat .env.schema`
`echo $SECRET`	`varlock load`
`printenv \| grep API`	`varlock load \| grep API`

Quick Reference

# Validate all secrets (shows masked values)
varlock load

# Quiet validation (no output on success)
varlock load --quiet

# Run command with secrets injected
varlock run -- npm start

# View schema (safe - no values)
cat .env.schema

Schema File

Create `.env.schema` to define variable types and sensitivity:

# Global defaults
# @defaultSensitive=true @defaultRequired=infer

# Public config
# @type=enum(development,staging,production) @sensitive=false
NODE_ENV=development

# Sensitive secrets
# @type=string(startsWith=sk_) @required @sensitive
STRIPE_SECRET_KEY=

# @type=url @required @sensitive
DATABASE_URL=