env-config-loader — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited env-config-loader (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when a script reads configuration from the environment and you want it to fail fast at startup with a clear message - "missing required keys: API_BASE, RUN_LIMIT" - instead of a KeyError halfway through, or a silent string-vs-int bug. It parses a simple .env, overlays the real environment, checks a required-key list once, and exposes typed getters (get_int, get_bool, get_float, get_list) that raise readable errors on bad values. No python-dotenv, no pydantic.
os.environ[...] scattered around with no central validation.pydantic-settings.User input:
Read API_BASE, RUN_LIMIT (int), and DRY_RUN (bool) from .env, and crash early with a clear message if any are missing.Output:
# Copy assets/config.py into your project, then:
from config import Config
cfg = Config.load(".env", required=["API_BASE", "RUN_LIMIT"])
base = cfg.get("API_BASE") # str, guaranteed present
limit = cfg.get_int("RUN_LIMIT") # ValueError if not an int
dry_run = cfg.get_bool("DRY_RUN", default=False) # true/1/yes/on -> True
tags = cfg.get_list("TAGS", default=[]) # "a,b,c" -> ["a", "b", "c"]If API_BASE or RUN_LIMIT is absent, Config.load raises ConfigError: missing required keys: ... at startup, before any work begins. .env ships as .env.example with placeholders only - never real values.
.env permissively: skip blanks/# comments, support export KEY=val and quoted values..env, so production overrides the file.required list once in load() and raise a single error listing every missing key.ConfigError on a bad value, never a silent default..env.example with obvious placeholders; keep the real .env gitignored.Reference: assets/config.py.
Distilled from production use across the author's automation projects. v1.0.0. See also: [[config-audit-checklist]], [[telegram-alerter]], [[slack-webhook-alerter]].
→ Build the full runnable bot with Trawlkit.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.