---
name: Get Env Var
slug: get-env-var
category: DevOps
description: "Get Env Var fetches a secret from the team's Infisical workspace into the current shell so subsequent commands can use it. Use it when a command needs a missing env var, token, or API key, or to load secrets from Infisical."
github: "https://github.com/Devin-AXIS/iPolloWork/tree/main/.opencode/skills/get-env-var"
language: TypeScript
stars: 4292
forks: 825
install: "npx degit https://github.com/Devin-AXIS/iPolloWork/tree/main/.opencode/skills/get-env-var ~/.claude/skills/get-env-var"
installs_to: ~/.claude/skills/get-env-var
source_path: .opencode/skills/get-env-var/SKILL.md
collection_size: 25
category_size: 798
collection_url: "https://dirskills.com/collections/Devin-AXIS/iPolloWork"
added: 2026-08-20T07:54:34.547Z
last_synced: 2026-08-20T07:54:34.547Z
canonical_url: "https://dirskills.com/skills/get-env-var"
---

# Get Env Var

Get Env Var fetches a secret from the team's Infisical workspace into the current shell so subsequent commands can use it. Use it when a command needs a missing env var, token, or API key, or to load secrets from Infisical.

**Install:**

```bash
npx degit https://github.com/Devin-AXIS/iPolloWork/tree/main/.opencode/skills/get-env-var ~/.claude/skills/get-env-var
```

## README

# Skill: get-env-var

Fetch a secret from the team's Infisical workspace into the current shell so the next command can use it.

## When to use

- A command or script needs an env var that is not set, such as `BLOB_READ_WRITE_TOKEN`.
- A token, API key, or other secret is missing from the environment.
- The user asks to load secrets from Infisical.

## Setup (once per machine)

- Install the CLI on macOS: `brew install infisical/get-cli/infisical`.
- Check auth with `infisical user get`; if it fails, run `infisical login` and complete the browser flow.
- For CI or other non-interactive runs, set `INFISICAL_TOKEN` from a machine identity; the CLI skips login when it is present.
- This repo is already project-linked via tracked `.infisical.json` (`workspaceId: "e9f4542a-8714-46c3-a8fd-99d8cb370aeb"`, empty `defaultEnvironment`). From the repo root, `infisical` defaults to the `dev` environment slug when `--env` is omitted.

## Fetch one secret into the environment

Run from the repo root:

```bash
export NAME="$(infisical secrets get NAME --plain --silent)"
```

- Replace `NAME` with the secret name.
- Add `--env <slug>` for a non-default environment; this repo defaults to `dev`.
- Add `--path /some/folder` when secrets are organized in folders.

## Inject everything into a command

Run the command through Infisical so all project secrets are available only to that process:

```bash
infisical run -- <command>
```

## Rules

- Never echo, print, or otherwise log secret values.
- Never write secrets to files, logs, commit messages, PR bodies, or comments.
- Only use `--plain` inside command substitution, as in `export NAME="$(...)"`.
- If a secret does not exist, STOP and tell the user exactly which secret name and environment to add in Infisical; do not invent values.