audit-env-parity
Pass
Audited by Gen Agent Trust Hub on Aug 25, 2026
Risk Level: SAFE
Full Analysis
- [SAFE]: The skill functions as a read-only auditor for environment configuration parity, assisting in identifying missing variables or naming drifts across development, staging, and production environments without modifying the system state.
- [DATA_EXPOSURE]: The skill analyzes sensitive configuration sources including
.envfiles and environment variables. It maintains safety through explicit directives: 'Never print secret values', 'Diff names only (never values)', and 'Three-way gap produced with no secret values'. - [INDIRECT_PROMPT_INJECTION]: The skill ingests data from external project code and configuration files. It addresses injection risks through the following evidence chain:
- Ingestion points: Reads
.env*files,.env.example, and code patterns likeprocess.env.X(SKILL.md). - Boundary markers: Explicitly mandates a 'no secret values' policy and the use of parity matrices to isolate data.
- Capability inventory: Requires file system read and environment variable access to perform comparisons.
- Sanitization: Limits the output to variable names and presence/absence status, filtering out the actual content of the secrets.
Audit Metadata