varlock

Varlock Security Skill

Secure-by-default environment variable management for Claude Code sessions.

Repository: https://github.com/dmno-dev/varlock

Documentation: https://varlock.dev

When to Use

• You need to work with environment variables or secrets in a Claude Code session without exposing their values.
• The task involves validating, loading, or auditing secrets while keeping them out of logs, diffs, and assistant context.
• You want a secure-by-default workflow built around Varlock instead of direct .env inspection.

Core Principle: Secrets Never Exposed

When working with Claude, secrets must NEVER appear in:

• Terminal output
• Claude's input/output context
• Log files or traces
• Git commits or diffs
• Error messages

This skill ensures all sensitive data is properly protected.

---

CRITICAL: Security Rules for Claude

Rule 1: Never Echo Secrets

# ❌ NEVER DO THIS - exposes secret to Claude's context
echo $CLERK_SECRET_KEY
cat .env | grep SECRET
printenv | grep API

# ✅ DO THIS - validates without exposing
varlock load --quiet && echo "✓ Secrets validated"

Rule 2: Never Read .env Directly

# ❌ NEVER DO THIS - exposes all secrets
cat .env
less .env
Read tool on .env file

# ✅ DO THIS - read schema (safe) not values
cat .env.schema
varlock load  # Shows masked values

Rule 3: Use Varlock for Validation