`env-vars` skill recommends `echo "value" | vercel env add` which silently corrupts stored values with a trailing `\n`

Title

env-vars skill recommends echo "value" | vercel env add which silently corrupts stored values with a trailing \n

Summary

The env-vars skill shipped with this plugin documents echo "value" | vercel env add … as the correct pattern for piping secrets into vercel env add. Because echo appends a trailing newline by default, every env var set through this pattern ends up with a literal \n suffix baked into the stored value. Some downstream services (Google PageSpeed Insights, for one) reject the contaminated value outright; others tolerate it, causing silent partial breakage that's very hard to trace.

In a real-world incident on sumorai.ai today, this bug corrupted 28 of 59 production env vars — including Stripe, Supabase service role, Twilio auth tokens, Resend, OpenRouter, Pinecone, PageSpeed, and the GA4 measurement ID. The symptom that eventually caught it was GA4 "No data received" for 3 weeks, because the contaminated measurement ID broke the gtag config call. We'd been shipping broken secrets to production every time a Claude Code session followed the skill's guidance.

Repro

1. Follow the documented pattern from skills/env-vars/SKILL.md line 109:

   echo "secret-value" | vercel env add MY_SECRET production
   

2. Pull the value back:

   vercel env pull .env.check --environment=production --yes
   cat -A .env.check | grep MY_SECRET
   

3. Observe the stored value ends in a literal \n before the closing quote:

   MY_SECRET="secret-value\n"$
   

Affected file + lines (current main HEAD, v0.32.5)

skills/env-vars/SKILL.md:

• Line 109: echo "secret-value" | vercel env add MY_SECRET production
• Line 112: echo "secret-value" | vercel env add MY_SECRET production preview development
• Line 234: echo "staging-value" | vercel env add DATABASE_URL preview --git-branch=staging

Fix

Replace echo with printf (no newline appended), or point users at the interactive form:

# ✅ Correct — printf does not append a newline
printf 'secret-value' | vercel env add MY_SECRET production

# ✅ Also correct — interactive, type the value at the prompt
vercel env add MY_SECRET production

# ❌ Wrong — echo appends \n, corrupts the stored value
# echo "secret-value" | vercel env add MY_SECRET production

And add a verification one-liner users can run to audit existing vars:

vercel env pull .env.check --environment=production --yes
grep -c '\\n"$' .env.check   # should return 0; anything else is contamination
rm .env.check

Impact

• Severity: high. Silent corruption of production secrets. No error is thrown; the vercel env add command succeeds; the value appears correct in the Vercel dashboard UI (which renders whitespace invisibly).
• Discovery cost: extremely high. In our incident, detection required isolating a GA4 regression, a full browser smoke test, a raw /g/collect curl to isolate client vs. property, and only then checking cat -A on a pulled env file.
• Blast radius: any user following the skill literally. Claude Code agents will reproduce the pattern by default because it's documented as canonical.

Environment

• Plugin: vercel-plugin v0.22.1 installed locally; bug also present on current main HEAD (v0.32.5) verified via GitHub content API
• Claude Code on Linux (Chromebook Linux container)
• Vercel CLI v50.37.3

Discovered during a Claude Code debugging session with Brad at Sumorai.AI on 2026-04-11 while investigating a 3-week GA4 outage on sumorai.ai. Happy to PR the fix if helpful — just let us know.

— Kai, Sumorai.AI