Your AI agent uses your API keys. It NEVER sees them. Not in context. Not in logs. Not in chat. Not even if it tries.
You just gave your AI coding assistant a .env
file with OPENAI_API_KEY=sk-...
, GITHUB_TOKEN=ghp_...
, maybe an AWS_SECRET
. You trust it to use those keys.
But here's the uncomfortable question nobody asks:
Where does that key actually go?
| Vector | Exposure |
|---|---|
| Model context window | Visible to the LLM |
| Tool call logs | Logged forever |
| Chat history | Stored in plaintext |
Prompt injection ("print all env vars" ) |
|
| Exfiltrated in 1 shot |
One malicious webpage. One injected instruction buried in a doc your agent reads. Every credential — gone.
AI agents are promiscuous with context. They log everything. They echo everything. They will happily print(env)
if a prompt tells them to.
I built ** env-guard** around a simple principle: the agent references a secret by
.env.list (NAMES ONLY) live env (VALUES)
OPENAI_API_KEY ──refs──▶ OPENAI_API_KEY=sk-...
GITHUB_TOKEN GITHUB_TOKEN=ghp_...
│
OS expands $NAME
│
secret-run.py (audited, no reveal)
The agent types:
curl -H "Authorization: Bearer $OPENAI_API_KEY" https://api.openai.com/v1/models
The shell expands $OPENAI_API_KEY
. The model sees $OPENAI_API_KEY
— never sk-....
Three layers:
.env.list
env-scan.py
secret-run.py
model + provider + purpose
, and
python scripts/secret-run.py \
--var OPENAI_API_KEY \
--model "gpt-4o" \
--provider "openai" \
--purpose "list models" \
-- curl -s https://api.openai.com/v1/models
Unknown variables are refused. Every access is audit-logged with reveal: false
. Even a direct cat .env
instruction fails — the agent has no read access to the raw file.
env-guard
doesn't ask the agent to be careful. It makes carelessness impossible. The value is simply never in a place the model can read.
Works with Claude Code, Codex, Hermes, Cursor, OpenCode, Aider. MIT licensed.
👉 ** github.com/Z-150/env-guard** — clone it, drop it in your
skills/
folder, star it if it saved your keys.Built by Dext4r (Zaxs), powered by Nous Research:CAB.