Agent Skills › different-ai/openwork › get-env-var

get-env-var

GitHub

从 Infisical 工作区获取环境变量或密钥注入当前 Shell，支持单值导出和命令级注入。用于解决脚本缺少 Token、API Key 等敏感信息的问题，确保后续命令可安全使用这些凭据。

.opencode/skills/get-env-var/SKILL.md different-ai/openwork

触发场景

需要未设置的环境变量如 BLOB_READ_WRITE_TOKEN 缺少 Token 或 API Key 请求从 Infisical 加载密钥

安装

npx skills add different-ai/openwork --skill get-env-var -g -y

更多选项

非标准路径

npx skills add https://github.com/different-ai/openwork/tree/dev/.opencode/skills/get-env-var -g -y

不安装直接使用

npx skills use different-ai/openwork@get-env-var

指定 Agent (Claude Code)

npx skills add different-ai/openwork --skill get-env-var -a claude-code -g -y

安装 repo 全部 skill

npx skills add different-ai/openwork --all -g -y

预览 repo 内 skill

npx skills add different-ai/openwork --list

SKILL.md

Frontmatter

{
    "name": "get-env-var",
    "description": "get an env var, fetch a secret, missing env var, missing token\/API key, load secrets from Infisical, infisical. Fetch secrets from the team's Infisical workspace into the shell environment so subsequent commands can use them."
}

Skill: get-env-var

Fetch a secret from the team's Infisical workspace into the current shell so the next command can use it.

When to use

A command or script needs an env var that is not set, such as BLOB_READ_WRITE_TOKEN.
A token, API key, or other secret is missing from the environment.
The user asks to load secrets from Infisical.

Setup (once per machine)

Install the CLI on macOS: brew install infisical/get-cli/infisical.
Check auth with infisical user get; if it fails, run infisical login and complete the browser flow.
For CI or other non-interactive runs, set INFISICAL_TOKEN from a machine identity; the CLI skips login when it is present.
This repo is already project-linked via tracked .infisical.json (workspaceId: "e9f4542a-8714-46c3-a8fd-99d8cb370aeb", empty defaultEnvironment). From the repo root, infisical defaults to the dev environment slug when --env is omitted.

Fetch one secret into the environment

Run from the repo root:

export NAME="$(infisical secrets get NAME --plain --silent)"

Replace NAME with the secret name.
Add --env <slug> for a non-default environment; this repo defaults to dev.
Add --path /some/folder when secrets are organized in folders.

Inject everything into a command

Run the command through Infisical so all project secrets are available only to that process:

infisical run -- <command>

Rules

Never echo, print, or otherwise log secret values.
Never write secrets to files, logs, commit messages, PR bodies, or comments.
Only use --plain inside command substitution, as in export NAME="$(...)".
If a secret does not exist, STOP and tell the user exactly which secret name and environment to add in Infisical; do not invent values.