# Get Env Var

Get an env var, fetch a secret, missing env var, missing token/API key, load secrets...

- Repository: https://github.com/different-ai/openwork (24362 stars)
- Category: Engineering
- License: see repository
- Last updated: 2026-11-01
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add different-ai/openwork --skill get-env-var -g -a claude-code -y`
Codex: `npx skills add different-ai/openwork --skill get-env-var -g -a codex -y`
Cursor: `npx skills add different-ai/openwork --skill get-env-var -g -a cursor -y`
Gemini CLI: `npx skills add different-ai/openwork --skill get-env-var -g -a gemini-cli -y`

## Description

get an env var, fetch a secret, missing env var, missing token/API key, load secrets from Infisical, infisical. Fetch secrets from the team's Infisical workspace into the shell environment so subsequent commands can use them.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Skill: get-env-var

Fetch a secret from the team's Infisical workspace into the current shell so the next command can use it.

## When to use

- A command or script needs an env var that is not set, such as `BLOB_READ_WRITE_TOKEN`.
- A token, API key, or other secret is missing from the environment.
- The user asks to load secrets from Infisical.

## Setup (once per machine)

- Install the CLI on macOS: `brew install infisical/get-cli/infisical`.
- Check `infisical --version`. The commands below need a current CLI: 0.28.x has no `user get` and no `--output json`, and behind `2>/dev/null` those fail silently with empty output. Upgrade with `brew upgrade infisical`.
- Check auth with `infisical user get`; if it fails or a command reports you are not logged in, run `infisical login` and complete the browser flow.
- For CI or other non-interactive runs, set `INFISICAL_TOKEN` from a machine identity; the CLI skips login when it is present.
- This repo is already project-linked via tracked `.infisical.json` (`workspaceId: "e9f4542a-8714-46c3-a8fd-99d8cb370aeb"`, empty `defaultEnvironment`). From the repo root, `infisical` defaults to the `dev` environment slug when `--env` is omitted.

## Fetch one secret into the environment

Run from the repo root:

```bash
export NAME="$(infisical secrets get NAME --plain --silent)"
```

- Replace `NAME` with the secret name.
- Add `--env <slug>` for a non-default environment; this repo defaults to `dev`.
- Add `--path /some/folder` when secrets are organized in folders. A folder's secrets do not appear at the root path.

## Known locations

The rest: https://github.com/different-ai/openwork/blob/HEAD/.opencode/skills/get-env-var/SKILL.md