A checker for .env files, which store application settings and secret keys, before deployment.

Use it to compare .env with .env.example and validate keys for services such as OpenAI, Stripe, Telegram, and Polygon.

It finds missing settings, unreplaced placeholders, malformed keys, formatting mistakes, and undocumented secrets that could break production.

env-doctor — Skill for Claude Code and Codex by tellmefrankie

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add tellmefrankie/news-engine --skill env-doctor

Clone the repo

git clone --depth 1 https://github.com/tellmefrankie/news-engine

Made for: Claude Code, Codex.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/tellmefrankie/news-engine/env-doctor/github.svg)](https://agentmods.dev/skills/tellmefrankie/news-engine/env-doctor)

Your own site

<a href="https://agentmods.dev/skills/tellmefrankie/news-engine/env-doctor"><img src="https://agentmods.dev/badge/skills/tellmefrankie/news-engine/env-doctor/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/tellmefrankie/news-engine/env-doctor"><img src="https://agentmods.dev/badge/skills/tellmefrankie/news-engine/env-doctor.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 0 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 889 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00000	$0.00889
Opus 5	$0.00000	$0.00445
Sonnet 5	$0.00000	$0.00178
Haiku 4.5	$0.00000	$0.00089

Measured 12d ago against content hash d2ac8398cfb1, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

env-doctor scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/env-doctor/SKILL.md · 105 lines

How it starts

The opening of the file, as written. The whole thing — 105 lines — stays where its author put it; the contents beside it link to each section on GitHub.

Env Doctor

Diagnose your .env file before deployment. Catches the configuration bugs that only show up in production at 2 AM.

What it does

Compares .env against .env.example — finds missing vars
Detects placeholder values never replaced (..., your-key-here, sk-ant-XXXX)
Flags secrets that look wrong (wrong prefix, wrong length, wrong format)
Checks for common mistakes: trailing spaces, Windows line endings, BOM markers
Warns about vars that exist in .env but not in .env.example (undocumented secrets)
Validates known API key formats (Anthropic, OpenAI, Stripe, Polygon, Telegram)

Usage

Run env doctor on this project.
Compare .env against .env.example.
Check for: missing vars, placeholder values, format issues, undocumented secrets.

Example Output

Env Doctor — 2026-05-13

MISSING VARS (in .env.example but not in .env)
  POLYGON_API_KEY          — required for options scanner
  NAVER_CLIENT_SECRET      — required for Korean news feed

PLACEHOLDER VALUES (never replaced)
  TWITTER_BEARER_TOKEN = "..."        — still default
  TWITTER_API_KEY = "..."             — still default

FORMAT WARNINGS
  ANTHROPIC_API_KEY = "sk-ant-api03-..."
    OK: correct prefix, length looks right

  TELEGRAM_BOT_TOKEN = "1234567890:ABC..."
    OK: correct format (number:hash)

  POLYGON_API_KEY = ""
    WARN: empty string — key exists but has no value

UNDOCUMENTED SECRETS (in .env but not in .env.example)
  DEVTO_API_KEY            — consider adding to .env.example with placeholder

ENCODING ISSUES
  None found (UTF-8, Unix line endings)

SUMMARY
  2 missing required vars
  2 placeholder vars not replaced
  1 undocumented secret
  0 encoding issues

Run: cp .env.example .env.local and fill in missing values

Validated API key formats

Service	Expected format	Example
Anthropic	`sk-ant-api03-...`	50+ chars
OpenAI	`sk-proj-...` or `sk-...`	51 chars
Stripe	`sk_live_...` or `sk_test_...`	32+ chars
Polygon.io	alphanumeric, 32 chars
Telegram Bot	`{number}:{hash}`	`1234567890:ABC...`
dev.to	alphanumeric, 20 chars

Read the full file on GitHub · 105 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 105 lines · 0 tokens per session scan A d2ac8398cfb1

Subscribe to this mod's changes

env-doctor is a skill published in the GitHub repository tellmefrankie/news-engine (1 stars, last pushed 4mo ago), licensed MIT. It costs nothing until one of its globs matches a file; then it loads 889 tokens. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Claude Code DevOps and cloud LLM ai-agent buildinpublic telegram-bot

writing-great-skills

Reference for writing and editing skills well — the vocabulary and principles that make a skill predictable.

fastagent-sh/fastagent · 24 tokens

subagent-driven-development

Execute plans via delegatetask subagents (2-stage review).

NousResearch/hermes-agent · 17 tokens

duckduckgo-search

Free keyless web, news, and image search via ddgs.

NousResearch/hermes-agent · 19 tokens

mcporter

List, auth, and call MCP servers/tools from the terminal.

NousResearch/hermes-agent · 16 tokens

article-writing

Write articles, guides, blog posts, tutorials, newsletter issues, and other long-form content in a distinctive voice derived from supplied examples or brand guidance. Use when the user wants polished written content longer than a paragraph, especially when voice consistency, structure, and credibility matter.

affaan-m/ECC · 57 tokens

mem0-oss-to-platform

Plan and then execute a migration of a project from the mem0 open-source / self-hosted SDK (the local Memory class) to the mem0 Platform / hosted / managed SDK (the MemoryClient class). Use this whenever a developer wants to move, switch, or migrate their mem0 usage off OSS/self-hosted to the hosted API — e.g.…

mem0ai/mem0 · 273 tokens