Cloak — Agent Security Skill

This file instructs AI coding agents to protect .env secrets using Cloak. Add it to your project root or append its contents to your CLAUDE.md / .cursorrules / .windsurfrules.

What is Cloak

Cloak encrypts real .env values into a vault and replaces them on disk with structurally valid sandbox values. The developer sees real values in their editor (the extension decrypts them). You (the agent) see sandbox values — that is by design.

Detection

On first interaction with a project, check for a .cloak file in the project root.

• .cloak exists → Cloak is active. Follow the rules below.
• .cloak does NOT exist but .env exists → suggest cloak init (always ask first, never run without consent).
• Neither exists → no action needed.

Rules