Skip to content
/env-checkStable

Validate environment variables, secrets, and configuration. Catches missing or misconfigured values before they cause runtime failures.

DevOpsSecurity· 2 min read

Quick import: Download the .md file and save it to .claude/commands/ (Claude Code), .cursorrules (Cursor), or paste as a system prompt in ChatGPT, Gemini, or any LLM API.

#What it does

The /env-check skill validates that all required environment variables, secrets, and configuration values are present and correctly formatted. It catches issues that would otherwise surface as cryptic runtime errors.

#How to use

bash
/env-check
/env-check production
/env-check --compare staging production

#Workflow

  1. Scan -- Finds all environment variable references across the codebase
  2. Map -- Cross-references against .env, .env.example, and CI/CD secrets
  3. Validate -- Checks format, type, and connectivity where possible
  4. Report -- Lists missing, unused, and misconfigured variables
  5. Sync -- Updates .env.example with any newly discovered variables

#What it validates

  • Presence -- Every referenced variable has a value in the target environment
  • Format -- URLs are valid, ports are numbers, booleans are actual booleans
  • Secrets -- API keys and tokens are not accidentally committed or exposed
  • Consistency -- Same variables exist across dev, staging, and production
  • Connectivity -- Database URLs, API endpoints, and Redis connections are reachable

#Example

bash
> /env-check production
 
# Scanning codebase for env references...
Found 14 environment variables across 8 files.
 
# Results:
  MISSING     STRIPE_WEBHOOK_SECRET  (referenced in src/api/webhook.ts)
  MISSING     REDIS_URL              (referenced in src/lib/cache.ts)
  INVALID     DATABASE_URL           (malformed connection string — missing port)
  UNUSED      LEGACY_API_KEY         (in .env but never referenced in code)
  EXPOSED     NEXT_PUBLIC_SECRET_KEY (secret value in a public variable)
 
# Fixed:
  Updated .env.example with REDIS_URL
  Flagged NEXT_PUBLIC_SECRET_KEY for renaming (secrets must not be public)
 
# 3 critical issues, 2 warnings
Orel Ohayon·
View all skills