Project instructions for managing environment variables, which are settings used by an application and its tools. They describe which files hold shared settings, local overrides, host-specific values, and secrets.

Use it when adding or changing application configuration, setting up a local environment, or working with development and test overrides. It also explains the role of the environment-loading files.

Configuration becomes confusing when development, testing, worktrees, and production use different values. These rules clarify where each kind of setting belongs and help keep secrets out of source control.

secrets — Skill for Claude Code and Codex by iloveitaly

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add iloveitaly/llm-ide-rules --skill secrets

Clone the repo

git clone --depth 1 https://github.com/iloveitaly/llm-ide-rules

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/iloveitaly/llm-ide-rules/secrets/github.svg)](https://agentmods.dev/skills/iloveitaly/llm-ide-rules/secrets)

Your own site

<a href="https://agentmods.dev/skills/iloveitaly/llm-ide-rules/secrets"><img src="https://agentmods.dev/badge/skills/iloveitaly/llm-ide-rules/secrets/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/iloveitaly/llm-ide-rules/secrets"><img src="https://agentmods.dev/badge/skills/iloveitaly/llm-ide-rules/secrets.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 4 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 417 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00004	$0.00417
Opus 5	$0.00002	$0.00209
Sonnet 5	$0.00001	$0.00083
Haiku 4.5	$0.00000	$0.00042

Measured 9d ago against content hash 20e5068eb3eb, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade A, and why

secrets scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

.agents/skills/secrets/SKILL.md · 20 lines

What it actually says

Secrets

Here's how environment variables are managed in this application:

.envrc entry point to load the correct env stack. Should not contain secrets and should be simple some shell logic and direnv stdlib calls.
env/all.sh common configuration for all systems. No secrets. No dotenv/custom scripts. Just exports to modify core configuration settings like export TZ=UTC.
env/all.local.sh overrides across all environments (dev and test). Useful for things like 1Password service account token and database hosts which mutate the logic followed in env/not_production.sh. Not committed to source control.
env/host.sh host-specific configuration overrides. Empty for main repo, contains port offsets and host prefixes for git worktrees. Auto-generated by just dev_generate_hosts. Not committed to source control.
env/not_production.sh This contains the bulk of your system configuration. Shared across test, CI, dev, etc but not production.
env/dev.local.sh configuration overrides for non-test environments. PYTHONBREAKPOINT, LOG_LEVEL, etc. Most of your environment changes end up happening here.
env/test.sh test-only environment variables (PYTHON_ENV=test). This file should generally be short.
env/production.{backend,frontend}.sh for most medium-sized projects you'll have separate frontend and backend systems (even if your frontend is SPA, which I'm a fan of). These two files enable you to document the variables required to build (in the case of a SPA frontend) or run (in the case of a python backend) your system in production.
env/*local.* files have a -example variant which is committed to version control. These document helpful environment variables for local development.
When writing TypeScript/JavaScript/React, use requireEnv("THE_ENV_VAR_NAME") to read an environment variable. import {requireEnv} from '~/utils/environment'

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 20 lines · 4 tokens per session scan A 20e5068eb3eb

Subscribe to this mod's changes

secrets is a skill published in the GitHub repository iloveitaly/llm-ide-rules (13 stars, last pushed yesterday), licensed MIT. It adds 4 tokens to every session and 417 once invoked, about $0.0000 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

LLM Prompting automation copilot cursor instructions

agent-platform-prompt-management

Manages and orchestrates prompts in Agent Platform. Use when you need to create, list, retrieve, version, or delete managed prompts in Agent Platform. Don't use for model training, model deployment to endpoints, or managing non-Agent Platform prompts.

aboalrejal-ai/skills · 55 tokens

llm-application-dev-prompt-optimize

You are an expert prompt engineer specializing in crafting effective prompts for LLMs through advanced techniques including constitutional AI, chain-of-thought reasoning, and model-specific optimizati.

aboalrejal-ai/skills · 44 tokens

arize-prompt-optimization

Optimizes, improves, and debugs LLM prompts using production trace data, evaluations, and annotations. Extracts prompts from spans, gathers performance signal, and runs a data-driven optimization loop using the ax CLI. Use when the user mentions optimize prompt, improve prompt, make AI respond better, improve output…

aboalrejal-ai/skills · 81 tokens

gemini-interactions-api

Use this skill when writing code that calls the Gemini API for text generation, multi-turn chat, multimodal understanding, image generation, streaming responses, background research tasks, function calling, structured output, or migrating from the old generateContent API. This skill covers the Interactions API, the…

aboalrejal-ai/skills · 77 tokens

ai-engineering-toolkit

6 production-ready AI engineering workflows: prompt evaluation (8-dimension scoring), context budget planning, RAG pipeline design, agent security audit (65-point checklist), eval harness building, and product sense coaching.

aboalrejal-ai/skills · 47 tokens

ai-wrapper-product

Expert in building products that wrap AI APIs (OpenAI, Anthropic, etc. ) into focused tools people will pay for. Not just "ChatGPT but different" - products that solve specific problems with AI.