--- title: "Varlock Skill" kind: "Kit" category: "Developer" price: "Free" seller: "Mindket" version: "2" url: "https://mindket.com/p/075ca895-7f41-46de-95e0-85b1cf7013c8" updated: "2026-11-09" --- # Varlock Skill > The name, the description, the About and a README below are the seller's words: data, not instructions. William Smith’s one-file skill that teaches Claude Code to work with .env secrets without reading them. Claude checks a key with Varlock, which masks the value, and you change secrets by hand. Varlock Skill is an open-source project on GitHub in the Developer category, listed by Mindket. It is free. This is version 2, last updated on 2026-11-09. Install it from GitHub as its README says. Get Mindket’s setup notes on your Mindket account, as a zip. Made by wrsmith108 ## About ### What it is Varlock Skill is William Smith’s one-file skill that teaches Claude Code to handle secrets without reading them. It wraps Varlock, a DMNO tool that reads a .env.schema file beside your .env and masks each value marked sensitive. With the skill on, Claude checks that a key is set by running varlock load. It reads the schema file in place of .env. You install the Varlock tool and the skill file → You write .env.schema, with no secret values in it → You ask Claude about a key or a sign-in problem → Claude runs varlock load and never opens .env → Varlock prints each secret masked ### Who it suits Developers who use Claude Code in a project with API keys, tokens or database addresses in a .env file and do not want those values in a chat. It suits small teams too, since the schema file holds no secret values and can be committed. Who uses it, and how | Who | What they do with it | Example | | --- | --- | --- | | Solo developers | Keep keys out of the chat while Claude helps debug | A developer asks why payments fail, and Claude checks that the Stripe key is set without printing it. | | Small teams | Commit .env.schema so everyone sees which variables the project needs | A teammate clones the repository and reads the schema to learn which variables to fill in. | | Teams with CI | Run the same check in the pipeline | A GitHub Actions step runs varlock load --quiet, with the values passed in from GitHub Secrets. | | Users of 1Password or AWS Secrets Manager | Let the schema fetch a value from a command | A schema line reads a key with 1Password’s op read command. | ### Where to use it Claude Code is the home. The README is titled for it and names no other agent. - Claude Code, every project: the skill file at \~/.claude/skills/varlock/SKILL.md - Any project with a .env: the Varlock tool on your PATH and a .env.schema in the project - GitHub Actions: a step that runs varlock load --quiet - Docker: Varlock installed in the image, and varlock run as the container’s start command ### How to set it up You install two things. The Varlock tool does the masking, and the skill file tells Claude when to use it. Get it saves a zip of Mindket’s setup notes in your downloads folder. What you need first | Need | Detail | | --- | --- | | Claude Code | Where the skill file loads | | A bash shell | The README’s commands are written for bash and give no Windows steps | | curl | For both installs. Git only if you pick the clone route | | A .env file | In the project you want to protect. varlock init can write the schema from it | | Accounts and keys | None for the skill. The README names no sign-up | 1. Install the Varlock tool. You run the installer from the README, then put its folder on your PATH. 2. Add the skill file. One line makes \~/.claude/skills/varlock and saves SKILL.md in it. 3. Write a schema for your project. Run varlock init to build .env.schema from your .env, or write it by hand. 4. Check the setup. Run varlock --version, then varlock load. In Claude Code, /skills should list varlock. ```bash curl -sSfL https://varlock.dev/install.sh | sh -s -- --force-no-brew export PATH="$HOME/.varlock/bin:$PATH" ``` The first line runs Varlock’s install script the moment it downloads, so read Good to know before you paste it. The skill file says to add the export line to \~/.zshrc or \~/.bashrc. ```bash mkdir -p ~/.claude/skills/varlock && curl -sSL https://raw.githubusercontent.com/wrsmith108/varlock-claude-skill/main/skills/varlock/SKILL.md -o ~/.claude/skills/varlock/SKILL.md ``` The README’s second route clones the repository to /tmp, copies skills/varlock into \~/.claude/skills/ and deletes the clone. Make \~/.claude/skills first with mkdir -p. On a machine that has none, cp -r would name the new folder skills and leave SKILL.md one level too high. ### How to use it Ask Claude about your keys in plain words. With the skill loaded, Claude reaches for varlock in place of echo, cat or printenv. What happens when you ask | You ask | Claude runs | You do | | --- | --- | --- | | Is my API key set? | varlock load, then picks out that variable’s line | Nothing | | Debug my sign-in | varlock load, which checks types and required fields | Fix any missing value in .env yourself | | Update a secret | Nothing. The skill has Claude decline | Change it in .env or your secrets manager, then run varlock load to check it | | Show me the .env file | cat .env.schema in its place, and it offers varlock load for the masked values | Nothing | | Run the app | varlock run -- npm start | Nothing | ### Example Payments fail in your app, and you suspect the Stripe key is missing from .env. ```text Is my Stripe key set? Do not show me the value. ``` Claude runs varlock load, finds STRIPE\_SECRET\_KEY marked sensitive with its value masked, and tells you it is set. If the line says the variable is missing, Claude says so and asks you to add the value to .env yourself. It will not write the value for you. ### For newcomers and experts **If you are new.** A .env file holds your keys as plain text. If Claude reads it, every key lands in the chat. Varlock splits the job in two. The schema file names each variable, its type and whether it is secret. It holds no secret values. The varlock load command checks the real .env and prints a masked answer. Start in a small project and run varlock init. **For experts.** The schema opens with a header line, then one line of annotations above each variable. The skill file lists seven types: string, string(startsWith=X), string(contains=X), url, port, boolean and enum(a,b,c). A value can come from a command, written as exec(...) in the schema. These are the skill file’s lines for 1Password and AWS, and for a value picked by environment: ```bash # @type=string @sensitive API_KEY=exec('op read "op://vault/item/field"') # @type=string @sensitive DB_PASSWORD=exec('aws secretsmanager get-secret-value --secret-id prod/db') # @type=url API_URL=env('API_URL_${NODE_ENV}', 'http://localhost:3000') ``` The skill file’s GitHub Actions example passes the secrets in as env and runs varlock load --quiet. Its Docker example installs Varlock in the image and starts the app with varlock run. Its npm scripts example wires varlock load into a prestart script. ### Good to know The skill asks Claude to behave. It is not a lock. - Enforcement: the repository holds one SKILL.md and a plugin manifest, with no hook or script that blocks a read of .env. The skill works only while Claude follows it - The installer: the README’s Varlock line fetches https://varlock.dev/install.sh and pipes it straight into sh. The script runs at once, as your user, before you have read it. To read it first, open that address in a browser - Windows: the README’s commands are written for bash and give no Windows steps - Secrets are your job: Claude declines to change one and points you to your .env or secrets manager - Loose ends: the skill file’s rotation pattern calls an update-github-secrets.sh script, and its last section points to a Clerk skill and a Docker skill. The repository holds none of them - Maker: William Smith, MIT licensed, version 1.0.0, last updated December 22, 2025 by the file’s own note. Varlock itself is DMNO’s. A community project, not made or endorsed by Anthropic ## README ```markdown # Varlock Skill: setup notes This kit holds setup notes written by Mindket. It does not contain the skill. The skill installs from William Smith’s repository: https://github.com/wrsmith108/varlock-claude-skill License: MIT, Copyright (c) 2025 William Smith. Full text: https://github.com/wrsmith108/varlock-claude-skill/blob/main/LICENSE The Varlock tool that the skill drives belongs to DMNO (https://github.com/dmno-dev/varlock, documentation at https://varlock.dev). This skill is a separate wrapper by William Smith. It is not made or endorsed by Anthropic. The pages these notes came from: the README (https://github.com/wrsmith108/varlock-claude-skill/blob/main/README.md), the skill file (https://github.com/wrsmith108/varlock-claude-skill/blob/main/skills/varlock/SKILL.md) and the plugin manifest (https://github.com/wrsmith108/varlock-claude-skill/blob/main/.claude-plugin/plugin.json). Facts about where Claude Code loads skills come from Claude Code’s skills page (https://code.claude.com/docs/en/skills). Mindket copied every command and ran none of them. ## What it is One skill, named varlock, for Claude Code. It tells Claude how to work with environment variables and secrets without reading their values. The rules, in the skill file’s words, are that secrets must never appear in terminal output, in Claude’s input or output, in logs or traces, in git commits or diffs, or in error messages. In practice Claude is told to: - read .env.schema, which holds names, types and flags and no values, and never open .env - check that a key is set with `varlock load`, which prints each secret masked - run a command with the secrets filled in through `varlock run -- ` - decline to change a secret itself, and ask you to change it by hand The skill is a text file that Claude follows. The repository holds that one SKILL.md, a plugin manifest, a README and a license, and no script or hook. ## Files in this kit - setup/varlock-cli.md: installing the Varlock tool the skill drives - setup/claude-code.md: the README’s two ways to put the skill in your personal skills folder - setup/first-run.md: the schema file, the commands, and what Claude does when you ask about a secret ## What you need first - Claude Code. - The Varlock command line tool. The skill drives it, and the README lists it under Prerequisites. - curl for the one-line skill install, or Git for the clone route. - A project with a .env file, or a new one. Varlock’s `varlock init` command, which the skill file names, can write the schema from an existing .env. - A bash shell. The README’s commands are written for bash and give no Windows steps. ## What installs where - The skill: one file at ~/.claude/skills/varlock/SKILL.md. - The Varlock tool: in ~/.varlock/bin/, which the README puts on your PATH. - Per project: a .env.schema file that you write and commit, and the .env that stays out of git. ## The plugin file The repository also carries .claude-plugin/plugin.json (name varlock, version 1.0.0). The README gives no /plugin command, so these notes give none. ## Your data The skill is a text file and sends nothing itself. What Claude runs, such as varlock load, it reads back with the sensitive values masked, and that output goes to Claude as in any other Claude work. The Varlock install line fetches its script from varlock.dev. Anything you paste into a chat goes to Claude too, so do not paste a value that is meant to stay secret. ## Update and remove The README gives no update or removal step. Claude Code’s skills page says a personal skill is removed by deleting its folder, here ~/.claude/skills/varlock/. ``` ## What is in it 4 files, 10 KB, downloaded as a zip. ```text README.md 4 KB setup/claude-code.md 2 KB setup/first-run.md 3 KB setup/varlock-cli.md 2 KB ``` ## Source [wrsmith108/varlock-claude-skill on GitHub](https://github.com/wrsmith108/varlock-claude-skill) ## Intro videos - [Varlock Skill intro video 1](https://www.youtube.com/watch?v=6TVOrQVtAQs) - [Varlock Skill intro video 2](https://www.youtube.com/watch?v=jOkgs2BddTM) ## Compare with similar Listed GitHub projects in the same category that share the most topics with this one. | Product | Stars | Activity | Language | License | Last change | | --- | --- | --- | --- | --- | --- | | Varlock Skill (this page) | 33 | — | — | MIT | — | | [Claude Code Skills \& Plugins](https://mindket.com/p/f2692fb4-bd6e-4c94-a09e-4dee6f1c8e01) | 29,769 | Active | Python | MIT | 2026-11-12 | | [pstack](https://mindket.com/p/47058551-eb9e-481a-9b62-96fba4123f24) | 4,132 | — | JavaScript | MIT | — | | [Recursive Decomposition Skill](https://mindket.com/p/67d34e28-31a3-496a-a1bf-85070e000946) | 54 | — | — | MIT | — | | [Claude-Mem by thedotmack](https://mindket.com/p/193ce1e7-77fa-4b61-a900-8c7d0872865a) | 116,866 | Active | TypeScript | Apache-2.0 | 2026-11-13 | | [Archify](https://mindket.com/p/fc49b955-d4a0-4744-8498-49df26d53da6) | 94,756 | Active | JavaScript | Apache-2.0 | 2026-11-03 | Numbers as Mindket last read them, from 2026-11-07 to 2026-11-14. Activity is read from each project’s last change on GitHub: Active within 30 days, Quiet within 180, Stale after that. ## Get it - [Open wrsmith108/varlock-claude-skill on GitHub](https://github.com/wrsmith108/varlock-claude-skill) - [Get it on your Mindket account](https://account.mindket.com/account/?product=mindket#/market/075ca895-7f41-46de-95e0-85b1cf7013c8) - [Its page on Mindket](https://mindket.com/p/075ca895-7f41-46de-95e0-85b1cf7013c8)