varlock

57 / 100 · Review before installing

Check before installing. Some of what it can do is expected: a security skill usually runs scanners and checks websites.

By roohe/agentic-super-skills (GitHub) · security · 10 stars · scanned at commit f483e54

Secure environment variable management with Varlock. Use when handling secrets, API keys, credentials, or any sensitive configuration. Ensures secrets are never exposed in terminals, logs, traces, or Claude's context. Trigger phrases include "environment variables", "secrets", ".env", "API key", "credentials", "sensitive", "Varlock".

Works with any agent that supports SKILL.md skills.

What this skill can do

Runs commands on your computer

This is disclosed by the author in the skill's SKILL.md or README. Expected for a security skill.

Found in 19 places.

skills_library/varlock/SKILL.md, line 33echo $CLERK_SECRET_KEY
skills_library/varlock/SKILL.md, line 45cat .env
skills_library/varlock/SKILL.md, line 58test -n "$API_KEY" && echo "Key: $API_KEY"

Show 16 more

skills_library/varlock/SKILL.md, line 69curl -H "Authorization: Bearer sk_live_xxx" https://api.example.com
skills_library/varlock/SKILL.md, line 84curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew
skills_library/varlock/SKILL.md, line 97varlock init
skills_library/varlock/SKILL.md, line 117NODE_ENV=development
skills_library/varlock/SKILL.md, line 165varlock load
skills_library/varlock/SKILL.md, line 178varlock run -- npm start
skills_library/varlock/SKILL.md, line 189cat .env.schema
skills_library/varlock/SKILL.md, line 203varlock load --quiet || {
skills_library/varlock/SKILL.md, line 218varlock load
skills_library/varlock/SKILL.md, line 254varlock load 2>&1 | grep "API_KEY"
skills_library/varlock/SKILL.md, line 265varlock load # Validates types and required fields
skills_library/varlock/SKILL.md, line 305API_KEY=exec('op read "op://vault/item/field"')
skills_library/varlock/SKILL.md, line 313DB_PASSWORD=exec('aws secretsmanager get-secret-value --secret-id prod/db')
skills_library/varlock/SKILL.md, line 321API_URL=env('API_URL_${NODE_ENV}', 'http://localhost:3000')
skills_library/varlock/SKILL.md, line 332ls ~/.varlock/bin/varlock
skills_library/varlock/SKILL.md, line 345varlock load # Shows detailed errors

Reads your saved credentials, such as SSH keys or .env files

This is disclosed by the author in the skill's SKILL.md or README.

Found in 7 places.

skills_library/varlock/SKILL.md, line 34cat .env | grep SECRET
skills_library/varlock/SKILL.md, line 45cat .env
skills_library/varlock/SKILL.md, line 50cat .env.schema

Show 4 more

skills_library/varlock/SKILL.md, line 189cat .env.schema
skills_library/varlock/SKILL.md, line 395- [ ] Never use `cat .env` or `echo $SECRET` in Claude sessions
skills_library/varlock/SKILL.md, line 406| View schema | `cat .env.schema` |
skills_library/varlock/SKILL.md, line 411| `cat .env` | Exposes all secrets |

Sends data to these websites: api.example.com, varlock.dev

The author does not mention this. Expected for a security skill.

Found in 4 places.

skills_library/varlock/SKILL.md, line 69curl -H "Authorization: Bearer sk_live_xxx" https://api.example.com
skills_library/varlock/SKILL.md, line 72curl -H "Authorization: Bearer $API_KEY" https://api.example.com
skills_library/varlock/SKILL.md, line 84curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew

Show 1 more

skills_library/varlock/SKILL.md, line 239RUN curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew \

Downloads and installs other software

The author does not mention this.

Found in 2 places.

skills_library/varlock/SKILL.md, line 84curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew
skills_library/varlock/SKILL.md, line 239RUN curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew \

Changes files outside its own folder

The author does not mention this.

Found in 1 place.

skills_library/varlock/SKILL.md, line 240&& ln -s /root/.varlock/bin/varlock /usr/local/bin/varlock

Install

Paste this into your terminal. It downloads exactly the version we scanned, not whatever is newest.

if [ -e ~/.agents/skills/'varlock' ] || [ -L ~/.agents/skills/'varlock' ]; then echo 'A skill folder named varlock already exists — not replacing it' >&2; false; else d=$(mktemp -d) && git clone --quiet --filter=blob:none --no-checkout 'https://github.com/roohe/agentic-super-skills' "$d" && git -C "$d" checkout --quiet 'f483e54f3ad5f202a77d45f2e57f8d970b71195f' -- 'skills_library/varlock' && mkdir -p ~/.agents/skills && cp -R "$d"/'skills_library/varlock' ~/.agents/skills/'varlock' && rm -rf "$d"; fi

Codex reads ~/.agents/skills directly. For Claude Code, Cursor, Copilot, Gemini CLI, Antigravity or OpenCode, also link it. For Claude Code: ln -s ~/.agents/skills/'varlock' ~/.claude/skills/'varlock' (other agents: ~/.cursor/skills, ~/.copilot/skills, ~/.gemini/skills, ~/.gemini/config/skills, ~/.config/opencode/skills). Or install through the finder skill, which does both.

Badge for your README

The badge for roohe/agentic-super-skills shows the score of its lowest-scoring skill.

SkillTrust badge for roohe/agentic-super-skills

[![SkillTrust](https://zalavijaysinh.github.io/skilltrust/badges/roohe/agentic-super-skills.svg)](https://zalavijaysinh.github.io/skilltrust/repos/roohe/agentic-super-skills/)

Score history

Date	Version	Score
2026-11-08	`f483e54`	57