npx claudepluginhub joaquimscosta/arkhe-claude-plugins --plugin devtoolsThis skill uses the workspace's default tool permissions.
Decrypt `.enc.yaml` files back to their plaintext `.env` originals.
Encrypts .env files using SOPS + age by converting dotenv to YAML to avoid SOPS bug #1435. Auto-detects unencrypted files in sops-setup projects.
Validates encryption implementations, audits crypto algorithms, and verifies key management in codebases and configs. Activates for data security reviews.
Manages configs across dev/staging/prod with .env files, Kubernetes ConfigMaps/Secrets, AWS SSM. Audits values, encrypts secrets via sops, validates schemas, detects drift, enables promotion workflows.
Share bugs, ideas, or general feedback.
Decrypt .enc.yaml files back to their plaintext .env originals.
Detect current state:
python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/detect_sops.py <project-root>
Verify prerequisites:
tools.sops.installed must be true — if not, tell user to install: brew install sops (macOS) or download binary (Linux)age_key.exists must be true — if not, guide user to place their age private key at the expected path, or set SOPS_AGE_KEY_FILE env varShow encrypted files from project.encrypted_files. If empty, report "No encrypted files found" and exit.
Use AskUserQuestion (multiSelect: true) — which files to decrypt. For each, show the target output name (e.g., .env.local.enc.yaml → .env.local). If the target file already exists, note it will be overwritten.
Decrypt each selected file (decrypt YAML, then convert to dotenv):
sops --decrypt <file>.enc.yaml > <file>.dec.yaml.tmp
python3 ${CLAUDE_SKILL_DIR}/../sops-setup/scripts/dotenv_yaml.py to-dotenv <file>.dec.yaml.tmp > <target-env-file>
rm <file>.dec.yaml.tmp
Where <target-env-file> is the encrypted filename with .enc.yaml suffix removed.
Example: .env.local.enc.yaml → .env.local
Verify each decrypted file exists and is non-empty.
Summary:
| Encrypted File | Decrypted To | Status |
|---------------|--------------|--------|
| .env.local.enc.yaml | .env.local | done |
Remind user: Do NOT commit the decrypted .env files — they should be in .gitignore.
.tmp files even if decryption fails.env files must stay out of git/devtools:sops-add-key on a machine that has access