# Config File Recognition

> How to find, read, and audit configuration files — includes concrete investigation steps like grepping for env vars, checking for hardcoded secrets, and mapping external service dependencies.

- **Type:** Skill
- **Install:** `agentstack add skill-esurovtsev-langchain-lab-config-file-recognition`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [esurovtsev](https://agentstack.voostack.com/s/esurovtsev)
- **Installs:** 0
- **Category:** [Security](https://agentstack.voostack.com/c/security)
- **Latest version:** 0.1.0
- **License:** MIT
- **Upstream author:** [esurovtsev](https://github.com/esurovtsev)
- **Source:** https://github.com/esurovtsev/langchain-lab/tree/main/experiments/01-agent-skills/skills/config_file_recognition

## Install

```sh
agentstack add skill-esurovtsev-langchain-lab-config-file-recognition
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Config File Recognition

## When to Use This Skill

When you need to understand how a project is configured, what external services it depends on, what environment variables it requires, or whether there are configuration issues (hardcoded secrets, missing defaults, inconsistent settings).

## Step-by-Step Investigation

### Step 1: Find All Config Files

Use `glob_search` to locate config files across the project:

- `glob_search(pattern="**/.env*")` — environment files
- `glob_search(pattern="**/*.json", path="config/")` — JSON config
- `glob_search(pattern="**/Dockerfile*")` — container config
- `glob_search(pattern="**/*.yaml")` or `**/*.yml` — YAML config
- `glob_search(pattern="**/requirements*.txt")` — Python dependencies
- `glob_search(pattern="**/package.json")` — Node.js dependencies

### Step 2: Read Safe Config Files First

Read in this priority order:

1. **`.env.example`** — safe to read, shows what variables the app expects
2. **`config/` directory files** — JSON/YAML config for services, servers, etc.
3. **`requirements.txt` / `package.json`** — dependencies reveal what services are used
4. **`Dockerfile` / `docker-compose.yml`** — runtime environment, ports, services

**Never read `.env` files** — they may contain real secrets.

### Step 3: Grep for Configuration Patterns in Code

Use `grep_search` to understand how config is consumed:

- `grep_search(query="os.getenv|os.environ|dotenv")` — find env var usage in Python
- `grep_search(query="process.env")` — find env var usage in JavaScript/Node
- `grep_search(query="localhost|127.0.0.1")` — find hardcoded local URLs
- `grep_search(query="port|PORT")` — find port configuration
- `grep_search(query="SECRET|KEY|TOKEN|PASSWORD")` — check for sensitive values in code

### Step 4: Map External Dependencies

From the config files and grep results, build a picture of:

- **Required environment variables** — list each with its purpose (from `.env.example` and `getenv` calls)
- **External services** — databases, APIs, caches (from connection strings and config)
- **Ports** — what ports the app listens on and connects to
- **API keys / credentials needed** — which services require authentication

### Step 5: Check for Issues

Look for common configuration problems:

- **Hardcoded secrets** — API keys, passwords, or tokens directly in source code (not in env vars)
- **Missing `.env.example`** — if code uses env vars but no example file documents them
- **Inconsistent ports** — frontend configured to call one port, backend listening on another
- **Hardcoded URLs** — `localhost` or IP addresses that won't work in production
- **Unpinned dependencies** — `requirements.txt` without version pins

## Report Format

Structure your findings as:

1. **Config Files Found** — list with brief purpose of each
2. **Environment Variables** — table of variable name, purpose, where it's used
3. **External Services** — what the app connects to and how
4. **Ports & URLs** — network configuration summary
5. **Issues Found** — any problems discovered (hardcoded secrets, missing config, etc.)

## Things to Avoid

- Never read `.env` files — they contain real secrets
- Never display actual secret values even if found in code — just note their location
- Don't assume config values are current — they might be defaults overridden at runtime
- Don't confuse `requirements.txt` (dependencies) with `config.yaml` (runtime settings)

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [esurovtsev](https://github.com/esurovtsev)
- **Source:** [esurovtsev/langchain-lab](https://github.com/esurovtsev/langchain-lab)
- **License:** MIT

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** yes
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-esurovtsev-langchain-lab-config-file-recognition
- Seller: https://agentstack.voostack.com/s/esurovtsev
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.