Envault

Skill DinanathDash/Envault/.agents/skills/envault

Auditable .env secret manager featuring aggressive CLI safeguards and GitHub JIT access.

Install

npx -y skills add DinanathDash/Envault --skill envault

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Official AI Agent Skill for Envault Secrets Management platform. Enforces strict zero-hardcode rules, Client-Side Encryption, and Human-in-the-Loop (HITL) approval workflows.

SKILL.md

1.8 KB, as published. Nobody here has run it

Envault Agent Skill

This skill provides critical instructions for interacting with the Envault Secrets Management platform. Envault uses strict Client-Side Encryption and Human-in-the-Loop (HITL) approvals. As an AI agent, you must strictly adhere to the following rules when working with Envault.

1. THE ZERO-HARDCODE RULE (`envault run`)

Envault injects secrets directly into process memory.

You must NEVER create, modify, or suggest creating .env files.
When writing scripts or running tests that require environment variables, you must execute them using the runtime wrapper: envault run --env <environment> -- <command>

2. THE HITL NAVIGATOR (Handling Mutations)

Envault's MCP server uses a delegated token model with active Human-in-the-Loop (HITL) safeguards.

When you attempt to mutate a secret (e.g., using envault_push or envault_deploy), the server intercepts the request and returns a 202 Accepted response. This response includes an approval_id and an approval_url.
A 202 Accepted is NOT a failure.
You must immediately stop execution, present the approval link to the user, and wait for the user to approve it via the UI or by typing envault approve <approval_id> in the terminal.
You must not retry the mutation automatically.

3. GIT COMPLIANCE

Envault has active safeguards regarding git tracking.

If an envault pull or envault deploy command fails because a file is already tracked in git, you must not try to force the operation.
Instead, you must:
1. Execute git rm --cached <file> to untrack the file.
2. Ensure the file is added to .gitignore.
3. Retry the Envault command.