agentsclimarketplace
Sign in

Code audit

Skill tspry/superpowers-devops/skills/code-audit

Use when reviewing code or a codebase for DevOps readiness, security issues, and missing best practicesFrom its SKILL.md

Install
npx -y skills add tspry/superpowers-devops --skill code-audit

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

  • 3 stars3 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

SKILL.md

2.5 KB, as published. Nobody here has run it

Code Audit

Works In Both Modes

  • Repo mode — scan actual files in the working directory
  • Chat mode — audit pasted code snippets or configs

Audit Categories

Run through each category. Report findings as: CRITICAL, WARNING, or INFO.

1. Secrets & Security

  • Hardcoded API keys, passwords, tokens, or credentials in code
  • .env files committed to git (check .gitignore)
  • Secrets passed as plain environment variables in CI configs
  • Insecure base images (e.g., FROM ubuntu:latest without pinned version)
  • Running containers as root when not needed
  • World-readable file permissions on sensitive configs

2. Container Readiness

  • Dockerfile present
  • .dockerignore present (prevents leaking local files into image)
  • Base image pinned to a specific version (not latest)
  • Multi-stage build used to minimize final image size
  • Health check defined (HEALTHCHECK in Dockerfile or K8s livenessProbe)
  • Non-root user defined in Dockerfile

3. Kubernetes / Orchestration

  • Resource requests and limits set for CPU and memory
  • livenessProbe and readinessProbe defined
  • replicas > 1 for production workloads
  • Namespace defined (not running in default)
  • Secrets stored in K8s Secrets, not ConfigMaps
  • imagePullPolicy: Always for mutable tags

4. CI/CD

  • CI config present (.github/workflows/, .gitlab-ci.yml, Jenkinsfile)
  • Tests run in CI before deploy
  • Linting/formatting check in CI
  • Secrets injected via CI secret store, not hardcoded
  • Deployment gated on test pass

5. Infrastructure as Code

  • IaC files present (Terraform, Ansible, Pulumi, etc.)
  • State backend configured (not local state for production)
  • Variables used instead of hardcoded values
  • Least-privilege IAM/RBAC roles
  • Resource tagging for cost tracking

6. Observability

  • Application logs written to stdout/stderr (not to files inside container)
  • Structured logging (JSON preferred)
  • Health check endpoint exposed (/health, /ready)
  • Metrics endpoint exposed if applicable (/metrics)

Reporting Format

For each finding:

[SEVERITY] Category — Description
  File: path/to/file (or "pasted code")
  Why it matters: ...
  Fix: ...

End with a summary count: X critical, Y warnings, Z info items.

Keep looking

Skills are one crate of 627,801. Ordering is by how many stacks a row turns up in, so the top of any crate is what has actually been picked rather than what has the most stars.