load-secrets — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited load-secrets (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Skill Studio keeps your API keys and secrets in one place and renders them to a single env file. Terminals launched from Skill Studio source that file automatically, so the secrets are normally already in your environment — check first (e.g. [ -n "$OPENAI_API_KEY" ]). Reach for this skill only as a last resort, when a command has actually failed because a key, token, or environment variable is missing.
Run this once, through eval, pointing at this skill's folder:
eval "$(bash ./activate.sh --print)"(Use the absolute path to activate.sh if your shell isn't already in this folder.) It exports every managed secret into the current shell and, where possible, wires your shell startup files so shells started later inherit them too. It prints only the variable names it activated — never the values.
Some agents (for example Codex) run each command in a fresh shell with a read-only HOME, so a separate activate step doesn't persist and the startup files can't be patched. There, source the env file in the same command that needs the secrets — this only reads a file, so it works even when HOME is read-only:
. "${SKILL_STUDIO_ENV:-$HOME/.config/skill-studio/env}" && your-commandIf it reports that no secrets are configured, add them in Skill Studio and run it again.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.