Sops encrypt

Skill joaquimscosta/arkhe-claude-plugins/plugins/devtools/skills/sops-encrypt

Encrypt .env files using SOPS + age. Converts dotenv to YAML format (avoids SOPS bug #1435), then encrypts. Auto-detects unencrypted .env files. Use when user mentions "encrypt env", "sops encrypt", "encrypt secrets", "encrypt .env", "encrypt environment", "re-encrypt", "update encrypted".From its SKILL.md

Install

npx -y skills add joaquimscosta/arkhe-claude-plugins --skill sops-encrypt

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

2 things to look at

21 stars21 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
runs commandsInstructs the agent to run 4 commands, including `python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>` and 3 more.

SKILL.md

2.3 KB, 547 tokens by cl100k_base, as published. Nobody here has run it

SOPS Encrypt

Encrypt .env files by converting to YAML and encrypting with SOPS + age.

Why YAML? SOPS dotenv store has a known bug (#1435) that corrupts backslash and \n sequences. The helper script converts dotenv→YAML before encryption.

Workflow

Detect current state:

python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>

Verify prerequisites:
- tools.sops.installed must be true — if not, tell user to run /devtools:sops-setup
- project.sops_yaml.exists must be true — if not, tell user to run /devtools:sops-setup
- age_key.exists must be true — if not, tell user to run /devtools:sops-setup
Show unencrypted .env files from project.env_files. If empty, report "No .env files found to encrypt" and exit.
Use AskUserQuestion (multiSelect: true) — which files to encrypt. List each .env* file. If a corresponding .enc.yaml file already exists, note it will be overwritten.

Encrypt each selected file (convert dotenv→YAML, then encrypt):

python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/dotenv_yaml.py to-yaml <file> > <file>.enc.yaml.tmp
sops --encrypt <file>.enc.yaml.tmp > <file>.enc.yaml
rm <file>.enc.yaml.tmp

Example: .env.local → .env.local.enc.yaml

Verify each encrypted file exists and is non-empty.

Summary:

| File | Encrypted To | Status |
|------|-------------|--------|
| .env.local | .env.local.enc.yaml | done |
| .env.production | .env.production.enc.yaml | done |

Remind user to commit the .enc.yaml files.

Key Rules

Always verify .sops.yaml exists before attempting encryption
Always convert dotenv→YAML before encrypting (use the helper script)
Warn if an .enc.yaml file will be overwritten
Never delete the original .env file — only create the .enc.yaml copy
Clean up .tmp files even if encryption fails

What ships with it

Read from the repository

Just SKILL.md. No reference files, no scripts.