config-secrets-environments

Purpose

Use this skill when behavior depends on configuration or secrets. The goal is explicit config ownership, validation, and environment parity without exposing credentials.

Inventory

Collect:

1. Config files and env var declarations.
2. Runtime readers and startup wiring.
3. Secret sources: env, secret manager, local keychain, BYOK storage.
4. Environment matrix: local, test, dev, staging, prod.
5. Rotation, revocation, and audit requirements.
6. Existing .env.example, schema, docs, and CI checks.

Never print real secrets. Redact values and report only names, source type, and wiring status.

Design Rules

• Define a schema for required and optional config.
• Fail closed for missing critical config; do not silently fall back to insecure or broad behavior.
• Keep defaults safe for local development and explicit for production.
• Separate build-time and runtime config.
• Keep tenant/user-provided keys isolated from platform keys.
• Document rotation and revocation paths.
• Verify config is wired into startup, not only declared.

Environment Matrix

Use this shape:

Key	Local	Test	Staging	Prod	Secret?	Owner	Rotation

Mark unknown values as unknown. Do not infer a production value from local files.

Output Shape

config_inventory:
environment_matrix:
secret_flows:
validation_and_startup_wiring:
drift_checks:
rotation_plan:
failure_behavior:
verification_commands: