Skip to content
cccskills
FreePublished on GitHub

sops-decrypt

Decrypt SOPS-encrypted YAML files back to .env format. Finds *.enc.yaml files, decrypts, and converts YAML back to dotenv. Use when user mentions "decrypt env", "sops decrypt", "decrypt secrets", "restore env", "decrypt .env", "restore secrets", "decrypt environment files".

The English summary is being prepared. Showing the original description.

See how to install

Files included (1)

  • SKILL.md2.4 KB

SKILL.md (original)

Review the instructions the agent will receive before you install.

SOPS Decrypt

Decrypt .enc.yaml files back to their plaintext .env originals.

Workflow

  1. Detect current state:

    python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>
    
  2. Verify prerequisites:

    • tools.sops.installed must be true — if not, tell user to install: brew install sops (macOS) or download binary (Linux)
    • age_key.exists must be true — if not, guide user to place their age private key at the expected path, or set SOPS_AGE_KEY_FILE env var
  3. Show encrypted files from project.encrypted_files. If empty, report "No encrypted files found" and exit.

  4. Use AskUserQuestion (multiSelect: true) — which files to decrypt. For each, show the target output name (e.g., .env.local.enc.yaml → .env.local). If the target file already exists, note it will be overwritten.

  5. Decrypt each selected file (decrypt YAML, then convert to dotenv):

    sops --decrypt <file>.enc.yaml > <file>.dec.yaml.tmp
    python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/dotenv_yaml.py to-dotenv <file>.dec.yaml.tmp > <target-env-file>
    rm <file>.dec.yaml.tmp
    

    Where <target-env-file> is the encrypted filename with .enc.yaml suffix removed. Example: .env.local.enc.yaml → .env.local

  6. Verify each decrypted file exists and is non-empty.

  7. Summary:

    | Encrypted File | Decrypted To | Status |
    |---------------|--------------|--------|
    | .env.local.enc.yaml | .env.local | done |
    

    Remind user: Do NOT commit the decrypted .env files — they should be in .gitignore.

Key Rules

  • Always check that the age private key exists before attempting decryption
  • Always convert YAML→dotenv after decrypting (use the helper script)
  • Warn if a decrypted file will overwrite an existing one
  • Clean up .tmp files even if decryption fails
  • After decryption, remind user that plaintext .env files must stay out of git
  • If decryption fails with "no identity matched", the machine's key is not authorized — suggest running /devtools:sops-add-key on a machine that has access

Reviews

No reviews yet. Tell others what you thought.

Comments

No login needed. Share how it worked for you, ask a question, or note where it did not run.

No comments yet. Be the first to write one.

Comments are published right away. Do not include personal information such as email addresses or phone numbers. Up to 2 URLs.

0 / 1,000 characters

This form is protected by reCAPTCHA, and the Google Privacy Policy and Terms of Service apply.

More skills from this repository

adr

Free

Create, review, and manage Architecture Decision Records (ADRs) with auto-numbering, template detection, quality review, and index maintenance. Use when user mentions "ADR", "architecture decision", "document this decision", "create ADR", "review ADR", editing ADR files (docs/adr/, doc/adr/, .adr/), or discussing architectural choices and tradeoffs.

The English summary is being prepared. Showing the original description.

joaquimscosta/arkhe-claude-plugins21Updated Oct 16, 2026

Analyze system architecture, module structure, API contracts, data models, and code patterns. Use when designing systems, reviewing module boundaries, evaluating API designs, analyzing data models, checking pattern conformance, tracing decisions, or reviewing frontend architecture. Triggers: "architecture", "module design", "API design", "data model", "boundaries", "patterns", "decisions", "frontend architecture".

The English summary is being prepared. Showing the original description.

joaquimscosta/arkhe-claude-plugins21Updated Oct 16, 2026

Converts natural-language descriptions or UI spec files into optimized Google Stitch prompts. Use when creating, refining, or validating design directives for Google Stitch. Use when user says "create a Stitch prompt", "optimize this for Stitch", "convert this spec to a Stitch prompt", "write a UI prompt", or mentions Google Stitch prompt authoring. Follows Stitch best practices with short, directive prompts focused on screens, structure, and visual hierarchy.

The English summary is being prepared. Showing the original description.

joaquimscosta/arkhe-claude-plugins21Updated Oct 16, 2026

Zero-dependency live-preview server providing an agent↔browser bidirectional companion. Watches a content directory, wraps HTML fragments in a frame template, broadcasts live-reload over WebSocket, and captures browser-side click events to a JSONL file. Use when an agent needs to show HTML to the user in a browser and react to clicks — mockups, design exploration, gallery browsing, multi-select choices, prototype iteration. Triggered by "live preview", "browser companion", "preview server", "browser mockup", "show in browser", "arkhe-preview", or any skill that wants to write HTML fragments and have the user see them reload in real time.

The English summary is being prepared. Showing the original description.

joaquimscosta/arkhe-claude-plugins21Updated Oct 16, 2026

Deletes merged git branches (local and remote) and flags stale unmerged branches for manual review. Use when user mentions "cleanup branches", "delete merged branches", "prune old branches", "remove stale branches", "branch cleanup", or runs /cleanup-branches command.

The English summary is being prepared. Showing the original description.

joaquimscosta/arkhe-claude-plugins21Updated Oct 16, 2026

Interactive Claude Code environment setup wizard. Detects existing configuration, guides through best-practice setup for Global CLAUDE.md, project scaffolding, MCP servers, hooks, custom agents, keybindings, and settings. Use when user runs /devtools:code-env-setup, mentions "setup claude code", "configure claude", "claude code setup", "environment setup", or "initialize claude code".

The English summary is being prepared. Showing the original description.

joaquimscosta/arkhe-claude-plugins21Updated Oct 16, 2026

See all skills by joaquimscosta

Report a problem with this skill