env-secrets-manager

The fragment is legitimate secret-management documentation with no clear evidence of malware or supply-chain sabotage. The Vault `eval` pipeline is a significant shell-injection risk if retrieved field names or output are compromised, and the Doppler download command creates plaintext secret material on disk. Avoid `eval`, validate variable names, prefer direct environment injection such as `doppler run`, and protect any local secret files with strict permissions and repository exclusions.