Skill: get-env-var
SkillDev toolsThis skill lets your AI fetch API keys and other secrets from your team's Infisical workspace and load them into the shell. That means commands needing a token or environment variable can run without you tracking down the value first. Fetched secrets stay in the shell environment, so every command after that can use them.
Available today. Use it from your connected AI after setup.
No other account needed.
Add the skill, then ask your AI to pull the secrets it needs from your team's Infisical workspace before running commands that require them.
Then ask your AI: use the Skill: get-env-var skill
What your AI can do with it
- Fetch a missing API key or token from your team's Infisical workspace
- Load secrets into the shell before running commands
- Look up a specific environment variable when asked
- Recover when a command reports a missing environment variable
- Make fetched secrets available to all later commands
What this skill tells your AI
The instructions your AI receives, as published by devin-axis/ipollowork in .opencode/skills/get-env-var/SKILL.md and read by ahel’s review.
Fetch a secret from the team's Infisical workspace into the current shell so the next command can use it.
When to use
- A command or script needs an env var that is not set, such as
BLOB_READ_WRITE_TOKEN. - A token, API key, or other secret is missing from the environment.
- The user asks to load secrets from Infisical.
Setup (once per machine)
- Install the CLI on macOS:
brew install infisical/get-cli/infisical. - Check auth with
infisical user get; if it fails, runinfisical loginand complete the browser flow. - For CI or other non-interactive runs, set
INFISICAL_TOKENfrom a machine identity; the CLI skips login when it is present. - This repo is already project-linked via tracked
.infisical.json(workspaceId: "e9f4542a-8714-46c3-a8fd-99d8cb370aeb", emptydefaultEnvironment). From the repo root,infisicaldefaults to thedevenvironment slug when--envis omitted.
Fetch one secret into the environment
Run from the repo root:
export NAME="$(infisical secrets get NAME --plain --silent)"
- Replace
NAMEwith the secret name. - Add
--env <slug>for a non-default environment; this repo defaults todev. - Add
--path /some/folderwhen secrets are organized in folders.
Inject everything into a command
Run the command through Infisical so all project secrets are available only to that process:
infisical run -- <command>
Rules
- Never echo, print, or otherwise log secret values.
- Never write secrets to files, logs, commit messages, PR bodies, or comments.
- Only use
--plaininside command substitution, as inexport NAME="$(...)". - If a secret does not exist, STOP and tell the user exactly which secret name and environment to add in Infisical; do not invent values.
Signals
- GitHub stars
- 6k
- Forks
- 1k
- Last commit
- Sep 2026
Advanced
- Catalog kind
- skill
- Gateway key
get-env-var- Source
- github.com/devin-axis/ipollowork