config-env-parameters
Manage Symfony configuration with .env files, parameters, secrets vault, and environment-specific settings
How do I install this agent skill?
npx skills add https://github.com/dev-toolings/superpowers-symfony --skill config-env-parametersIs this agent skill safe to install?
- Gen Agent Trust Hubpass
This skill provides instructions for managing Symfony configuration and secrets. It correctly includes best practices for security, such as avoiding the commitment of local environment files and sensitive keys. However, it naturally interacts with sensitive files like .env and the secrets vault, presenting an inherent data exposure surface. Furthermore, the skill processes potentially untrusted configuration files, which creates a surface for indirect prompt injection attacks.
- Socketpass
No alerts
- Snykpass
Risk: LOW · No issues
What does this agent skill do?
Config Env Parameters (Symfony)
Use when
- Adding or changing an environment variable, a parameter, or a secret.
- A value differs between environments (dev, test, prod).
- Casting or parsing env values (
int:,bool:,json:,csv:,file:). - Storing credentials in the Symfony secrets vault.
Default workflow
- Decide where the value lives:
.envdefault,.env.local, real environment, or the vault for secrets. - Declare it with a safe committed default, never a real credential.
- Inject it with
%env(...)%and the right processor, through a parameter or#[Autowire]. - Put environment-specific settings in
config/packages/<env>/orwhen@<env>blocks. - Fail fast in the service when a required value is empty.
Guardrails
- Never commit
.env.local,.env.*.localor the vault decryption key. - In production, set variables in the server or container environment, not in files.
- Env values are strings until processed: cast them, do not compare
"false"tofalse. - Remember the loading order:
.env,.env.local(skipped in test),.env.<env>,.env.<env>.local.
Progressive disclosure
- Use this file for execution posture and risk controls.
- Open references when deep implementation details are needed.
Output contract
- Where each new value is defined, per environment.
- The injection point and the processor used.
- Secrets added to the vault, named but never printed.
References
reference.md
How can the creator link this skill?
Add the canonical catalog link to the repository README so users can inspect current installs and available audits. The publishing guide covers the complete discovery path.
<a href="https://skillzs.dev/skills/dev-toolings/superpowers-symfony/config-env-parameters">View config-env-parameters on skillZs</a>