Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add atretyak1985/swarmery --skill env-checkgit clone --depth 1 https://github.com/atretyak1985/swarmeryWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/atretyak1985/swarmery/env-check)<a href="https://agentmods.dev/skills/atretyak1985/swarmery/env-check"><img src="https://agentmods.dev/badge/skills/atretyak1985/swarmery/env-check/github.svg" alt="Measured on agentmods" height="20"></a>Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.
<a href="https://agentmods.dev/skills/atretyak1985/swarmery/env-check"><img src="https://agentmods.dev/badge/skills/atretyak1985/swarmery/env-check.svg" alt="Reviewed on agentmods" width="80" height="20"></a>What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00054 | $0.00885 |
| Opus 5.5 | $0.00022 | $0.00354 |
| Sonnet 5.5 | $0.00011 | $0.00177 |
| Haiku 4.5 | $0.00005 | $0.00089 |
Grade A, and why
env-check scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 1mo ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 68 lines — stays where its author put it; the contents beside it link to each section on GitHub.
Purpose
Audit environment variables across all of the project's repositories (.claude/project.json → repos) to find missing, unused, undocumented, or inconsistent env vars and flag security issues. Produces a structured markdown report with file:line citations. Static analysis only — no write access, no live-cluster introspection.
Rules (never violate)
- NEVER print actual secret values — flag only presence and
file:linelocation. - Every finding carries a
file:linecitation; the report stays within 150 lines and states a confidence level (HIGH, or MEDIUM when dynamic access patterns were seen). - Exclude
node_modules/,.next/,__pycache__/,venv/, and test fixtures — fixture placeholders are not "missing" vars. process.env[dynamicKey]/os.environ[...]bracket access is a low-confidence finding, never a definitive one.NEXT_PUBLIC_*vars are client-exposed, never treated as server-side.- Stop and ask on: an apparent-secret
*.populated.yamloutside.gitignore, more than 5 undocumented in-use vars, or dynamic access above 30% of usage.
Resources
- Read
resources/audit-procedure.mdwhen running an audit — the 6-step procedure with per-stack grep patterns, known-variable baseline, self-check, common mistakes, escalation, failure modes. - Read
resources/output-template.mdwhen compiling results — the report template and a full cross-repo worked example.
How to use
What it does
Audits environment variables across every repository in your project. It reads code, config, and example files without writing anything, then reports which variables are used but undocumented, documented but unused, named inconsistently across repos, or look like hardcoded secrets — each finding with a file:line citation.
When to use it
- You added, removed, or renamed an env var and want every repo to agree on name and default.
- You are cutting a release and need proof all required variables appear in
env.example. - You are reviewing a PR touching service config,
env.example, or a typed env accessor. - A deployment failed and you suspect a missing or misspelled variable.
What ships with it
2 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 1mo ago First seen · 68 lines · 54 tokens per session scan A d6752343bd8a
env-check is a skill published in the GitHub repository atretyak1985/swarmery (7 stars, last pushed today), licensed Apache-2.0. It adds 54 tokens to every session and 885 once invoked, about $0.0002 per session on Opus 5.5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-09-03.
Other skills, from other repositories
dependency-versions
MUST consult this skill before answering whenever the user's task involves external versioned dependencies — even if you think you can handle it directly. This applies to: checking if packages/tools are up to date, upgrading npm/pip/cargo/go dependencies, planning or writing CI/CD workflows (GitHub Actions, CircleCI…
finish
Ship phase — merge, PR, keep, or discard with pre-merge verification.
gws-quick-ref
Quick reference for gws CLI syntax — core patterns, key flags, pagination, field masks, and output formats.
excalidraw
Create or extend editable Excalidraw diagrams from descriptions or repository evidence using a local skeleton-to-scene converter.
style-ops
Maintain, validate or report on the Fakoli principles ledger, checking evidence pointers and keeping its Markdown projection synchronized.
gws-events-subscribe
Google Workspace Events: Subscribe to Workspace events and stream them as NDJSON.