Skill: get-env-var

Fetch a secret from the team's Infisical workspace into the current shell so the next command can use it.

When to use

• A command or script needs an env var that is not set, such as BLOB_READ_WRITE_TOKEN.
• A token, API key, or other secret is missing from the environment.
• The user asks to load secrets from Infisical.

Setup (once per machine)

• Install the CLI on macOS: brew install infisical/get-cli/infisical.
• Check infisical --version. The commands below need a current CLI: 0.28.x has no user get and no --output json, and behind 2>/dev/null those fail silently with empty output. Upgrade with brew upgrade infisical.
• Check auth with infisical user get; if it fails or a command reports you are not logged in, run infisical login and complete the browser flow.
• For CI or other non-interactive runs, set INFISICAL_TOKEN from a machine identity; the CLI skips login when it is present.
• This repo is already project-linked via tracked .infisical.json (workspaceId: "e9f4542a-8714-46c3-a8fd-99d8cb370aeb", empty defaultEnvironment). From the repo root, infisical defaults to the dev environment slug when --env is omitted.

Fetch one secret into the environment

Run from the repo root:

export NAME="$(infisical secrets get NAME --plain --silent)"

• Replace NAME with the secret name.
• Add --env <slug> for a non-default environment; this repo defaults to dev.
• Add --path /some/folder when secrets are organized in folders. A folder's secrets do not appear at the root path.

Known locations