Security audit
dotenv — Node.js Environment Variable Loader
Security checks across malware telemetry and agentic risk
Overview
The skill is mostly a standard dotenv guide, but it warrants review because it handles secrets and includes an unsafe example that prints an API key.
Use this skill cautiously for secret management. Do not let generated code print real environment variable values, keep .env and .env.keys out of version control, prefer verified package-manager installs over curl-to-shell, and only use dotenvx command substitution with trusted .env files.
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.