Mobile environment config

Skill ahtishamshahzad/agent_dev_flow/.ai/skills/mobile/mobile-environment-config

Use to plan mobile environment configuration — dev/staging/prod separation, env-var handling, base URLs and keys via config (not hard-coded), and safe client exposure. No secrets in the client bundle.From its SKILL.md

Install

npx -y skills add ahtishamshahzad/agent_dev_flow --skill mobile-environment-config

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

24 days oldThe repository was created 24 days ago. New is not bad, but a brand new repository carrying a familiar-sounding name is the shape a typosquat arrives in, and there has been no time for anyone else to find a problem with it.
0 stars0 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

3.2 KB, 647 tokens by cl100k_base, as published. Nobody here has run it

Mobile Environment Config

Purpose

Plan environment configuration: how dev/staging/prod differ, how config/keys are supplied (not hard-coded), and how to avoid shipping secrets in the client bundle.

When to Use

When the app has multiple environments or external config/keys.
Not for a single trivial constant.

Inputs

Environments and their differences.
Which values are public-safe vs sensitive; runtime (Expo/CLI).

Discovery Questions

Which environments exist and how do they differ (URLs, keys, flags)?
How is config supplied per build (Expo extra/env, CLI env)?
Which values are safe on the client vs must stay server-side?
How does the build select the environment?

Responsibilities

Define environment separation (dev/staging/prod).
Supply config via the runtime's mechanism (Expo config/extra, CLI env), not hard-coded.
Keep secrets out of the client bundle; only public-safe values ship (../../security-review).
Wire base URLs/keys into API and services by environment.

Required Workflow

List environments + differences.
Choose the runtime config mechanism.
Separate public-safe from sensitive values.
Wire env into API/services.
Record the config plan.

Decision Rules

Client bundles are public — never ship a real secret in one; sensitive operations proxy through a backend.
Config comes from the build's environment mechanism, not literals.
Fail fast if a required config value is missing.

Rules

No secrets or private keys in the client bundle.
No hard-coded URLs/keys — use config.
Coordinate deep exposure review with ../../security-review / ../../environment-audit.

Anti-Patterns

Hard-coded base URLs/keys.
Shipping backend secrets to the client.
One config blob with no env separation.
No failure on missing critical config.

Validation Checklist

Environments defined + differences documented.
Runtime config mechanism chosen.
Public-safe vs sensitive separated.
No secrets in the client bundle.
Env wired into API/services; fail-fast on missing config.

Definition of Done

A recorded environment-config plan: dev/staging/prod separation, runtime-appropriate config supply, sensitive values kept off the client, and fail-fast on missing config.

Related Skills

mobile-api-integration, mobile-secure-storage, ../../security-review, ../../environment-audit, expo-foundation, react-native-cli-foundation

Related Knowledge

../../../knowledge/ (environments, endpoints).

Related References

../../../references/mobile/native/ when populated.

Context Loading Guidance

Requires: environments, value sensitivity, runtime.
Does not require: the whole app source, unrelated references, every mobile skill.
May load: ../../security-review, ../../environment-audit.
Stop when: the config plan is recorded.

Token Efficiency Guidance

Focus on config/env files and value sensitivity; don't read app logic.

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.