A setup wizard for SOPS and age encryption, used to protect environment files such as .env files. It detects the current project state, prepares keys and configuration, and encrypts environment files as YAML.

Use it to install or check SOPS and age, create encryption keys and .sops.yaml, inspect environment files, update ignore rules, and prepare encrypted files.

It helps teams share configuration secrets between machines without storing the original environment files in readable form. YAML is used to avoid a documented SOPS dotenv-format problem with backslashes and line breaks.

sops-setup — Skill for Claude Code by joaquimscosta

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add joaquimscosta/arkhe-claude-plugins --skill sops-setup

Clone the repo

git clone --depth 1 https://github.com/joaquimscosta/arkhe-claude-plugins

Made for: Claude Code.

Or install devtools, the plugin that ships this one along with the rest of its 9 skills.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/joaquimscosta/arkhe-claude-plugins/sops-setup/github.svg)](https://agentmods.dev/skills/joaquimscosta/arkhe-claude-plugins/sops-setup)

Your own site

<a href="https://agentmods.dev/skills/joaquimscosta/arkhe-claude-plugins/sops-setup"><img src="https://agentmods.dev/badge/skills/joaquimscosta/arkhe-claude-plugins/sops-setup/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/joaquimscosta/arkhe-claude-plugins/sops-setup"><img src="https://agentmods.dev/badge/skills/joaquimscosta/arkhe-claude-plugins/sops-setup.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 101 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 1,740 The whole file, excluding the scripts and references it only reads on demand.

Security scan B 1 finding. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00101	$0.01740
Opus 5	$0.00051	$0.00870
Sonnet 5	$0.00020	$0.00348
Haiku 4.5	$0.00010	$0.00174

Measured 9d ago against content hash ac2deb597ee6, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-09, from the pricing page.

Security

Grade B, and why

sops-setup scanned grade B with 1 finding against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 9d ago.

The scan reads SKILL.md. This mod also ships 2 executable files (scripts/detect_sops.py, scripts/dotenv_yaml.py), listed below but not scanned — reading those needs a real analyzer, not pattern matching.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Asks for rootmediumPrivilege escalation

A mod that escalates privileges can change anything on the machine, not only the project.

- **Set permissions**: `chmod 600 ~/.config/sops/age/keys.txt`

plugins/devtools/skills/sops-setup/SKILL.md · 149 lines

How it starts

The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.

SOPS + age Setup Wizard

Interactive setup for SOPS + age encryption. Detects current state and guides through configuration.

Important: This skill uses YAML format for encrypted files (not dotenv) because SOPS has a known bug (#1435) where the dotenv store corrupts backslash and \n sequences on decrypt. A helper script handles dotenv↔YAML conversion transparently.

Pre-flight

Run the detection script to understand current state:

python3 ${CLAUDE_SKILL_DIR}/scripts/detect_sops.py <project-root>

Two-Phase Workflow

Phase 1: Detect

Run the detector on the project root:

python3 ${CLAUDE_SKILL_DIR}/scripts/detect_sops.py <project-root>

Summarize findings — show a status table:

Component	Status	Detail
sops binary	installed/missing	version, path
age binary	installed/missing	version, path
age key	exists/missing	public key (truncated)
.sops.yaml	exists/missing	# of authorized keys
.env files	N found	list of filenames
encrypted files	N found	list of *.enc.yaml files
.gitignore	ok/needs update	env ignored, enc.yaml not ignored

Phase 2: Configure

Walk through each missing component. Skip steps where detection shows everything is already configured.

Install tools (if tools.sops.installed or tools.age.installed is false):
- Show install commands based on os field:
  - macOS: brew install sops age
  - Linux: Show download URLs for latest binaries from GitHub releases
- After user confirms installation, re-run detector to verify
Generate age key (if age_key.exists is false):
- Create directory: mkdir -p ~/.config/sops/age
- Generate key: age-keygen -o ~/.config/sops/age/keys.txt
- Set permissions: chmod 600 ~/.config/sops/age/keys.txt
- Display the public key and tell user to save it somewhere safe (password manager, secure note)

Read the full file on GitHub · 149 lines

Files

What ships with it

6 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

9d ago First seen · 149 lines · 101 tokens per session scan B ac2deb597ee6

Subscribe to this mod's changes

sops-setup is a skill published in the GitHub repository joaquimscosta/arkhe-claude-plugins (21 stars, last pushed 25d ago), licensed MIT. It adds 101 tokens to every session and 1,740 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it B with 1 finding (asks for root). No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.

Claude Code DevOps and cloud Security ai-agents ai-developer-tools anthropic claude-code-agents claude-code-plugins

skill-capture

Turn a recurring in-session workflow into a reusable Claude Code skill. Load this the moment you notice you have run the SAME multi-step sequence (same ordered steps or commands, small variation allowed) about three times in the current session, or when open candidates are waiting in .credo/skill-candidates.md at…

Marcel-Bich/marcel-bich-claude-marketplace · 170 tokens

test-writer

Generate comprehensive tests including unit, integration, and property-based tests.

kivo360/OmoiOS · 12 tokens

quick

Fast path — skip the full workflow for small tasks under 3 files.

fakoli/fakoli-plugins · 16 tokens

git-workflow

Git branching, commits, and PR workflow following GitFlow conventions.