Does it support dependency and supply chain checks?

Yes, it reviews your project dependencies to ensure versions are pinned in lockfiles and checks for known vulnerabilities or incompatible licenses.

How does this skill help prevent security breaches?

It scans your code for hardcoded API keys, unmasked secrets in logs, and ensures that sensitive files like .env are correctly excluded from version control.

Can it validate my feature flag implementation?

Yes, it checks if feature flags have safe defaults, are properly documented with owners, and have a clear cleanup plan to avoid technical debt.

What is environment parity and why does this skill check it?

Environment parity ensures your app behaves the same way in dev and prod. The skill checks for explicit configuration instead of implicit hacks like checking hostnames.

Configuration & Secrets Reviewer

Name: Configuration & Secrets Reviewer
Author: xinbenlv

byxinbenlv

安全与测试

Audits application configurations and secret management to ensure production safety, environment parity, and security compliance.

关于

The Configuration & Secrets Reviewer skill functions as a virtual Platform Engineer, meticulously auditing how your software handles settings, sensitive credentials, and feature flags. It identifies dangerous defaults that could cause data loss, detects hardcoded secrets before they reach version control, and ensures that environments remain consistent to prevent 'works on my machine' bugs. By applying 12-factor app principles and fail-fast validation patterns, this skill helps developers build resilient, secure systems that are easy to manage across dev, staging, and production.

主要功能

Identifies hardcoded secrets and unmasked logging of sensitive credentials
Reviews dependency pinning and supply chain security in lockfiles
Validates production-safe defaults and mandatory startup configuration checks
Ensures environment parity to eliminate implicit environment detection bugs
Audits feature flag lifecycles, including documentation and cleanup plans
0 GitHub stars

使用场景

Performing security audits on environment variable handling during pull requests
Standardizing configuration schemas across microservices to ensure consistent behavior
Verifying that new feature flags include proper defaults and testing coverage

关于

主要功能

Identifies hardcoded secrets and unmasked logging of sensitive credentials
Reviews dependency pinning and supply chain security in lockfiles
Validates production-safe defaults and mandatory startup configuration checks
Ensures environment parity to eliminate implicit environment detection bugs
Audits feature flag lifecycles, including documentation and cleanup plans
0 GitHub stars

使用场景

Performing security audits on environment variable handling during pull requests
Standardizing configuration schemas across microservices to ensure consistent behavior
Verifying that new feature flags include proper defaults and testing coverage