Sops decrypt

Skill joaquimscosta/arkhe-claude-plugins/plugins/devtools/skills/sops-decrypt

Supercharge Claude Code with 109 specialized components — 22 agents, 32 commands, 55 skills across 13 modular plugins. Deep reasoning, autonomous dev loops, DDD architecture, design system enforcement, git automation, and more.

Install

npx -y skills add joaquimscosta/arkhe-claude-plugins --skill sops-decrypt

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Decrypt SOPS-encrypted YAML files back to .env format. Finds *.enc.yaml files, decrypts, and converts YAML back to dotenv. Use when user mentions "decrypt env", "sops decrypt", "decrypt secrets", "restore env", "decrypt .env", "restore secrets", "decrypt environment files".

SKILL.md

2.4 KB, as published. Nobody here has run it

SOPS Decrypt

Decrypt .enc.yaml files back to their plaintext .env originals.

Workflow

Detect current state:

python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>

Verify prerequisites:
- tools.sops.installed must be true — if not, tell user to install: brew install sops (macOS) or download binary (Linux)
- age_key.exists must be true — if not, guide user to place their age private key at the expected path, or set SOPS_AGE_KEY_FILE env var
Show encrypted files from project.encrypted_files. If empty, report "No encrypted files found" and exit.
Use AskUserQuestion (multiSelect: true) — which files to decrypt. For each, show the target output name (e.g., .env.local.enc.yaml → .env.local). If the target file already exists, note it will be overwritten.

Decrypt each selected file (decrypt YAML, then convert to dotenv):

sops --decrypt <file>.enc.yaml > <file>.dec.yaml.tmp
python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/dotenv_yaml.py to-dotenv <file>.dec.yaml.tmp > <target-env-file>
rm <file>.dec.yaml.tmp

Where <target-env-file> is the encrypted filename with .enc.yaml suffix removed. Example: .env.local.enc.yaml → .env.local

Verify each decrypted file exists and is non-empty.

Summary:

| Encrypted File | Decrypted To | Status |
|---------------|--------------|--------|
| .env.local.enc.yaml | .env.local | done |

Remind user: Do NOT commit the decrypted .env files — they should be in .gitignore.

Key Rules