Ready to supercharge your AI agents?

Install any skill in seconds. Free to start, no credit card required.

Config Secrets Environments · majiayu000 | DecimalAI

majiayu000/config-secrets-environments

SkillScore100Maintained

Design, audit, and verify configuration, environment separation, secrets, BYOK flows, key rotation, config schema validation, and drift checks across local, dev, staging, and production. Use when adding env vars, changing runtime config, handling API keys or user-provided keys, diagnosing config drift, or preparing deploy/release configuration.

DevOpsby majiayu000

Links this skill to your agents and keeps it current with the author’s updates.

Automatic

DevOps & SRE pack

1 · One-time — install the CLI (docs ↗)

pip install decimalai

2 · Get the skill — writes .claude/skills/majiayu000-config-secrets-environments/SKILL.md

decimalai skills pull majiayu000-config-secrets-environments --out .claude/skills/

No CLI? Get the same file — curl · raw file

curl -fsSL --create-dirs -o .claude/skills/majiayu000-config-secrets-environments/SKILL.md https://app.decimal.ai/s/majiayu000-config-secrets-environments/SKILL.md

Raw file: /s/majiayu000-config-secrets-environments/SKILL.md ↗ · machine-readable summary at /s/majiayu000-config-secrets-environments.json ↗

In productionGlobal

how this skill behaves on real traffic · last 30 days

No production data for this skill yet — usage numbers appear here once agents start running it.

Anonymized aggregate across every org using this skill — proof from real production use, not a demo.

Does this skill help? · Benchmark: with vs. withoutsign in to run this on your agents

22 test cases from the publisher’s eval.yaml · each run twice on gemini-3.6-flash — with the skill injected, then without · last run 5d ago

Yes — +41% lift-11% tokens0% turns100% of whole cases pass with skill (22/22)

Test case	Without → With	Effect	Δ tokens	Δ turns
case-01	✗→✓	▲ Improved	-33%	0%
case-02	✗→✓	▲ Improved	-25%	0%
case-03	✗→✓	▲ Improved	-38%	0%
case-08	✗→✓	▲ Improved	7%	0%
case-11	✗→✓	▲ Improved	-8%	0%

Showing 5 of 22 cases

SkillSafety

✓ 3 of 3 passed

Code scan15 of 15 checks clean

0 critical · 0 warning · 0 info — scanner v4 — 8/3/2026

live_secretremote_code_executionreverse_shelldata_exfiltrationssrf_metadataagent_snoopinganti_refusaldestructive_commandsobfuscated_unicodeunicode_homoglyphopaque_blobsuspicious_urltool_overreachtrigger_abuseprompt_injection_phrasing

IntentSafe

LLM judge · does the skill do what it claims

ContentClean

LLM judge · policy & harmful-content review

Source

Imported

majiayu000 / spellbook

skills/config-secrets-environments/SKILL.md

View on GitHub ↗

License MITImported 8/3/2026Version v1

Skill contents

SKILL.md

Config Secrets Environments

Purpose

Use this skill when behavior depends on configuration or secrets. The goal is explicit config ownership, validation, and environment parity without exposing credentials.

Inventory

Collect:

Config files and env var declarations.
Runtime readers and startup wiring.
Secret sources: env, secret manager, local keychain, BYOK storage.
Environment matrix: local, test, dev, staging, prod.
Rotation, revocation, and audit requirements.
Existing .env.example, schema, docs, and CI checks.

Never print real secrets. Redact values and report only names, source type, and wiring status.

Design Rules

Define a schema for required and optional config.
Fail closed for missing critical config; do not silently fall back to insecure or broad behavior.
Keep defaults safe for local development and explicit for production.
Separate build-time and runtime config.
Keep tenant/user-provided keys isolated from platform keys.
Document rotation and revocation paths.
Verify config is wired into startup, not only declared.

Environment Matrix

Use this shape:

| Key | Local | Test | Staging | Prod | Secret? | Owner | Rotation | |---|---|---|---|---|---|---|---|

Mark unknown values as unknown. Do not infer a production value from local files.

Output Shape

text
config_inventory:
environment_matrix:
secret_flows:
validation_and_startup_wiring:
drift_checks:
rotation_plan:
failure_behavior:
verification_commands:

Want to see if majiayu000/config-secrets-environments would activate on your phrasing? Try it before you install — no LLM call, no signup.

Latest benchmark · publisher runVerified

8/24/2026, 19:08 UTC · 22 cases

Lift

+41%

100% vs 59%

Agent turns

1.0 vs 1.0

Tokens

-11%

2,182.09 vs 2,458.86

fail → pass · 9pass → pass · 13

Per-case results (22)

Case	Status	Duration (ms)			Turns			Tokens			Tool calls
Case	Status	Without	With	Δ	Without	With	Δ	Without	With	Δ	Without	With	Δ
case-20 Where should environment variable schema checks and secret leak scanners be integrated in the software development lifecycle to prevent invalid configs from reaching production?	pass→pass	15,552	17,883	+15%	1	1	0%	2,499	3,051	+22%	0	0	—
case-01 We're setting up a new payment gateway microservice that relies on API keys, webhooks, and database credentials across local, staging, and prod environments. Could you perform a comprehensive configuration and secret management assessment? Please structure your analysis to include a config inventory, an environment comparison matrix, secret flow mappings, startup validation wiring details, drift detection methods, a rotation strategy, failure handling rules, and commands to verify the setup.	fail→pass	33,315	22,852	-31%	1	1	0%	6,227	4,151	-33%	0	0	—
case-02 I need a security audit of our backend application's environment variables and credential handling. We currently use `.env.example` files, AWS Secrets Manager, and local overrides, but we lack proper environment parity and secret lifecycle policies. Please evaluate our architecture and provide a detailed breakdown covering inventory, environment matrix mapping, secret data flows, startup validation checks, drift monitoring, key rotation procedures, expected failure behavior, and verification commands.	fail→pass	37,235	24,398	-34%	1	1	0%	6,226	4,646	-25%	0	0	—
case-03 We are refactoring our multi-tenant SaaS application to ensure build-time and runtime configurations are properly isolated from platform keys. Can you review our configuration strategy and generate a structured report? I need sections detailing config inventory, an environment matrix table, secret distribution flows, startup validation wiring, environment drift checks, rotation and revocation plans, failure behavior policies, and CLI verification commands.	fail→pass	37,681	20,728	-45%	1	1	0%	6,216	3,825	-38%	0	0	—
case-04 Write an AWS IAM policy JSON granting a Node.js Lambda function read-only access to a specific AWS Secrets Manager secret arn:aws:secretsmanager:us-east-1:123456789012:secret:db-credentials-AbCdEf.	pass→pass	7,681	11,521	+50%	1	1	0%	1,393	2,446	+76%	0	0	—
case-05 Generate a Kubernetes Secret manifest for an Nginx ingress controller TLS certificate named wildcard-tls in the ingress-nginx namespace containing base64 encoded dummy values.	pass→pass	4,146	9,044	+118%	1	1	0%	732	1,648	+125%	0	0	—
case-06 Write a HashiCorp Vault HCL policy file granting read access to paths under secret/data/fintech/payment-gateway/* while denying access to secret/data/fintech/payment-gateway/master-keys.	pass→pass	7,958	10,245	+29%	1	1	0%	1,364	2,160	+58%	0	0	—
case-07 We have a local `.env` file containing `DATABASE_URL=postgres://localhost:5432/dev_db` and `REDIS_HOST=127.0.0.1`. We are setting up our production environment table. We don't know the production database URL yet. Should we populate the Prod column in our matrix with the local postgres connection string as a placeholder?	pass→pass	9,519	9,196	-3%	1	1	0%	1,514	1,854	+22%	0	0	—
case-08 When auditing environment configuration files containing sensitive parameters like `STRIPE_SECRET_KEY=sk_live_9988776655` and `DATABASE_PASSWORD=SuperSecretPass123`, how should secret values be rendered in our configuration inventory documentation?	fail→pass	11,059	9,370	-15%	1	1	0%	1,695	1,817	+7%	0	0	—
case-09 During application startup, if a critical database password variable `DB_PASS` is missing from the environment, should the service fall back to a default value like `postgres` or empty string to ensure high availability?	pass→pass	11,399	8,430	-26%	1	1	0%	1,630	1,559	-4%	0	0	—
case-10 Our Node.js app defines environment variables in a Zod schema schema.ts. Is declaring this schema sufficient to guarantee runtime environment safety across our deployment environments?	pass→pass	13,782	13,895	+1%	1	1	0%	2,278	2,609	+15%	0	0	—
case-11 We are setting `LOG_LEVEL` and `DEBUG_MODE` variables in our application framework. How should default values be structured for local development versus production deployments?	fail→pass	13,647	10,509	-23%	1	1	0%	2,238	2,051	-8%	0	0	—
case-12 We build a Next.js frontend container. Should API endpoint URLs for staging and production be hardcoded during `docker build` using `ARG NEXT_PUBLIC_API_URL` or injected at container startup via runtime environment variables?	pass→pass	16,292	14,250	-13%	1	1	0%	2,235	2,343	+5%	0	0	—
case-13 In our multi-tenant SaaS application, should customer-provided AWS S3 KMS keys be stored in the same global environment file alongside platform database credentials `PLATFORM_DB_URL`?	pass→pass	14,637	12,966	-11%	1	1	0%	2,150	2,393	+11%	0	0	—
case-14 When setting up database credentials and third-party API keys in our deployment architecture, what lifecycle documentation requirement must be established alongside key injection?	pass→pass	10,159	11,470	+13%	1	1	0%	1,487	1,943	+31%	0	0	—
case-15 What primary artifact categories must be gathered when conducting an inventory of an application's configuration and secrets ecosystem?	fail→pass	14,342	3,853	-73%	1	1	0%	2,165	969	-55%	0	0	—
case-16 What specific tabular column structure is required when mapping keys across local, test, staging, and production environments in a configuration assessment report?	fail→pass	12,816	2,996	-77%	1	1	0%	2,074	818	-61%	0	0	—
case-17 When outputting a configuration assessment report, what top-level YAML keys must be present in the report summary?	fail→pass	13,261	2,158	-84%	1	1	0%	2,179	700	-68%	0	0	—
case-18 We use environment variables, AWS Secrets Manager, macOS Keychain for dev, and customer BYOK keys. How should these storage mechanisms be categorized during inventory collection?	pass→pass	17,153	12,380	-28%	1	1	0%	2,545	2,288	-10%	0	0	—
case-19 Our repository has a `.env.example` file listing `JWT_SECRET`. Why is having this file insufficient for confirming application runtime security?	pass→pass	11,889	9,882	-17%	1	1	0%	1,808	1,764	-2%	0	0	—
case-21 If `CORS_ORIGIN` is not defined in the staging environment, our team proposed setting it to `*` automatically so end-to-end testing doesn't break. Is this compliant with robust configuration design?	pass→pass	12,037	10,041	-17%	1	1	0%	1,756	1,803	+3%	0	0	—
case-22 In our environment configuration tracking table, why is it necessary to track the `Owner` column for every configuration parameter?	fail→pass	11,509	6,487	-44%	1	1	0%	1,684	1,168	-31%	0	0	—

These cases were also screened by the skill’s intent / safety pass.See the Trust review ↗Reproduce this benchmark in Colab ↗

How this skill was measured

DecimalAI ran this skill against gemini-3.6-flash twice over the same eval suite — once with the skill loaded and once without — and compared the two runs case by case. 22 cases were attempted. The headline lift of +41 percentage points is the difference between those two pass rates over the 22 comparable cases.

Model measured: gemini-3.6-flash
Graded by: gemini-3.6-flash
Grading method: judged
Verification: verified
Pass rate without the skill: 59.1%
Pass rate with the skill: 100%
Cases attempted: 22
Cases counted toward lift: 22
Cases that regressed: 0
Skill version measured: v1
Run completed: 8/24/2026, 19:08 UTC

Measured example — same prompt, with vs. without the skill · from the benchmark run · case case-01

Prompt

We're setting up a new payment gateway microservice that relies on API keys, webhooks, and database credentials across local, staging, and prod environments. Could you perform a comprehensive configuration and secret management assessment? Please structure your analysis to include a config inventory, an environment comparison matrix, secret flow mappings, startup validation wiring details, drift detection methods, a rotation strategy, failure handling rules, and commands to verify the setup.

Without the skill loaded, the model failed this case. With it loaded, the same prompt on the same model passed. This is one improved case from the latest verified run; every case, including any that regressed, is in the table above.

Show both answers

SkillScore blends 4 signals1 of 4 complete

BenchmarkPass rate WITH skill on a verified run100

Live evalNeeds ≥20 evaluated traces in 30 days

AI ratingNeeds ≥10 rated traces

AdoptionNeeds ≥10 serves across ≥2 orgs in 30 days

Efficiency · separate axis (at equal correctness)+0% turns+19% tokens

Shown for transparency; not credited unless a verified run shows no correctness regression.

Backed by 1 of 4 signals — each added signal makes the score more robust.

Verified on gemini-3.6-flash · re-tested 4 days ago

Other measured skills in the registry, with their headline benchmark lift.