Is the Varlock skill free?

Yes. The skill itself is free from wrsmith108/varlock-claude-skill. SkillProof publishes the install command and an independent test verdict at no cost.

What is the Varlock SkillProof Score?

8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.

How do I install Varlock?

Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.

Can I use Varlock with Cursor, Copilot, Gemini CLI, Codex or other AI tools?

The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.

Varlock

Teaches Claude to never echo secrets — validates .env vars through the Varlock CLI instead of cat/echo.

by wrsmith108 · wrsmith108/varlock-claude-skill

Works with setup

Install — copy the command Download source ↗

Test report

Verdict: Works with setup
Score: 8.8/10
Tested: Jul 14, 2026
Environment: Claude Code 2.x (agent harness)
Upstream re-checked: Aug 10, 2026 · 6d153cd

Asked to add and verify a STRIPE_SECRET_KEY without leaking it into chat: both baseline and skill avoided printing the raw value, but only the skill produced the actual working commands (`varlock load`, `.env.schema` @sensitive annotations, masked ▒▒▒▒▒ output) — real friction is that `varlock` is a separate CLI you must install first (`curl -sSfL https://varlock.dev/install.sh | sh`), clearly disclosed in the skill's own Quick Start.

Scored on four weighted criteria — install, triggering, output vs. baseline, docs. How scoring works

Installs cleanly 5/5
Triggers reliably 5/5
Output vs. baseline 8/10
Docs & honesty 4/5

What Varlock does

Gives Claude behavioral rules and CLI commands (varlock load, .env.schema @sensitive annotations) to validate and reference environment variables and API keys without ever printing raw secret values into the session, logs, or git diffs. Triggers on .env, API key, credential, or secrets-handling requests. The masked-validation commands only run once the separate open-source Varlock CLI is installed; the behavioral guidance (never cat .env / never echo $SECRET) applies immediately with zero install.

How to install Varlock

git clone https://github.com/wrsmith108/varlock-claude-skill
cd varlock-claude-skill
mkdir -p ~/.claude/skills
cp -r skills/varlock ~/.claude/skills/varlock

Skills live in ~/.claude/skills/ (global) or .claude/skills/ (per-project). Restart Claude Code after installing.

Commands — how to trigger Varlock

/varlock Teaches Claude to never echo secrets — validates .env vars through the Varlock CLI instead of cat/echo.

It also activates on plain-language prompts like these:

Add a new Stripe secret key to my env config without printing it
Check that STRIPE_SECRET_KEY is set correctly without leaking its value
Validate my .env variables are present without echoing any secrets

Frequently asked questions

Is the Varlock skill free?: Yes. The skill itself is free from wrsmith108/varlock-claude-skill. SkillProof publishes the install command and an independent test verdict at no cost.
Does Varlock work with Claude Code?: We tested it with Claude Code 2.x (agent harness) on Jul 14, 2026. Verdict: Works with setup. Asked to add and verify a STRIPE_SECRET_KEY without leaking it into chat: both baseline and skill avoided printing the raw value, but only the skill produced the actual working commands (`varlock load`, `.env.schema` @sensitive annotations, masked ▒▒▒▒▒ output) — real friction is that `varlock` is a separate CLI you must install first (`curl -sSfL https://varlock.dev/install.sh | sh`), clearly disclosed in the skill's own Quick Start.
What is the Varlock SkillProof Score?: 8.8/10 — installs cleanly 5/5, triggers reliably 5/5, output vs. baseline 8/10, docs & honesty 4/5.
How do I install Varlock?: Copy the install command from this page, run it in your terminal, and restart Claude Code. Skills live in ~/.claude/skills/ (global) or .claude/skills/ inside a project.
Can I use Varlock with Cursor, Copilot, Gemini CLI, Codex or other AI tools?: The SKILL.md format is native to Claude (Claude Code, Desktop, claude.ai). The instructions inside adapt to other assistants: Cursor rules, GitHub Copilot instructions, Windsurf rules, Custom GPTs, AGENTS.md for OpenAI Codex, and GEMINI.md for Google Gemini CLI — our conversion guides cover each, and the free converter on the tools page does the wrapping for you.