enc.log

Fri Feb 10 07:22:33 PST 2017 No leaked environment variable
Fri Feb 10 07:23:05 PST 2017 Environment variable leaked! 2017-02-10 07:22:37 -0800
Fri Feb 10 07:24:01 PST 2017 Environment variable leaked! 2017-02-10 07:22:37 -0800
Fri Feb 10 07:25:01 PST 2017 Environment variable leaked! 2017-02-10 07:22:37 -0800
Fri Feb 10 07:25:49 PST 2017 Environment variable leaked! 2017-02-10 07:22:37 -0800

enc.sh

#!/bin/sh

if [ -n "$LEAKED_ENVIRONMENT_VARIABLE" ]; then
  echo "$(date) Environment variable leaked! ${LEAKED_ENVIRONMENT_VARIABLE}" >> /tmp/enc.log
else
  echo "$(date) No leaked environment variable" >> /tmp/enc.log
fi

# The rest of your ENC here

function.rb

module Puppet::Parser::Functions
  newfunction(:leak, :type => :rvalue, :doc => 'Intentionally leak an environment variable') do |_args|
    if ENV['LEAKED_ENVIRONMENT_VARIABLE']
      "Enviroment leaked: #{ENV['LEAKED_ENVIRONMENT_VARIABLE']}; it's now #{Time.now.to_s}"
    else
      ENV['LEAKED_ENVIRONMENT_VARIABLE'] = Time.now.to_s
      "No environment leaked; it's now #{Time.now.to_s}"
    end
  end
end

manifest.pp

class test {
  file { '/tmp/environment-leak':
    content => leak(),
  }
}