Skills deployment-audit-skill
📦
deployment-audit-skill
Content revision r1 High Risk ⚙️ External commands🔑 Env variables
Audit Deployment Health and Runtime Issues
Deployment failures are hard to diagnose when logs, settings, and build output are split across platforms. This skill guides Claude, Codex, and Claude Code through focused checks for deployment readiness.
Supports: Claude Codex Code(CC)
Stop for confirmation before installing.
Review the plan and obtain explicit user consent before changing files.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "deployment-audit-skill" from https://skillstore.io/skills/cleanexpo-deployment-audit-skill.md and its manifest at https://skillstore.io/api/skills/cleanexpo-deployment-audit-skill/manifest. Verify the artifact. Stop and obtain explicit user consent before installing or changing files.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "deployment-audit-skill". Check why the deployment keeps restarting.
Expected outcome:
- Deployment health summary: the service restarts during startup after a required setting is missing.
- Recommended action: verify hosted settings, redeploy, and monitor restart logs for the next release.
Using "deployment-audit-skill". Compare environment settings before launch.
Expected outcome:
- Environment review: two required variable names are missing from the hosted deployment settings.
- No secret values are included. Review provider settings and update the missing names before launch.
Using "deployment-audit-skill". Prepare a release readiness summary.
Expected outcome:
- Readiness status: build checks pass, but API health needs follow-up.
- Priority issue: database connectivity is unstable during runtime validation.
Security Audit
High Riskv9 • 7/5/2026 Open versioned report
The skill is a legitimate deployment troubleshooting guide, but it directs agents to run cloud CLI commands and inspect environment configuration. Several static findings are false positives from Markdown formatting, while secret handling, .env.local access, log retrieval, build execution, and package installation guidance remain real risks.
1
Files scanned
100
Lines analyzed
10
Review items
0
False positives ignored
Confirmed security concerns (6)
High
Environment file access
- `.env.local`
The skill explicitly includes .env.local in the environment consistency sources. That file commonly contains local secrets and credentials.
High
Environment file access
- Local `.env.local`
The health check process tells agents to compare local .env.local against hosted provider settings. This is direct sensitive environment file handling.
High
Environment file access
**Fix**: Check `.env.local` and deployment settings
The remediation guidance tells agents to check .env.local when an environment variable is invalid. That can expose secrets unless redaction is required.
High
Environment variant files
- `.env.local`
The skill explicitly names .env.local as a source for environment consistency checks. Environment variant files often hold sensitive credentials.
High
Environment variant files
- Local `.env.local`
The health check process includes local .env.local as an input. This is a real environment variant file access risk.
High
Environment variant files
**Fix**: Check `.env.local` and deployment settings
The common fix recommends checking .env.local and deployment settings. The instruction is legitimate but can expose environment file contents.
Capability review items (10)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
High
Generic API/secret keys
ANTHROPIC_API_KEY
ANTHROPIC_API_KEY appears in the environment checklist used for deployment consistency checks. The line does not contain a value, but the workflow can lead agents to inspect sensitive credentials.
High
Generic API/secret keys
STRIPE_SECRET_KEY
STRIPE_SECRET_KEY appears in the environment checklist used for deployment consistency checks. The line does not contain a value, but the workflow can lead agents to inspect payment credentials.
High
Generic API/secret keys
SENDGRID_API_KEY
SENDGRID_API_KEY appears in the optional environment checklist. This is a secret-bearing variable type that may be inspected during the requested sync process.
High
Generic API/secret keys
RESEND_API_KEY
RESEND_API_KEY appears in the optional environment checklist. This is a secret-bearing variable type that may be inspected during the requested sync process.
High
Generic API/secret keys
SEMRUSH_API_KEY
SEMRUSH_API_KEY appears in the optional environment checklist. No value is shown, but the skill context asks agents to compare environment configuration.
Medium
Ruby/shell backtick execution
- `doctl apps list`
The skill directs use of doctl to enumerate DigitalOcean apps. This is legitimate for deployment work but exposes cloud application inventory through an external command.
Medium
Ruby/shell backtick execution
- `doctl apps logs <app-id> --type=run_restarted`
The skill directs retrieval of DigitalOcean restart logs. Deployment logs can contain stack traces, tokens, internal URLs, or user data.
Medium
Ruby/shell backtick execution
- `doctl apps logs <app-id> <component> --type=run_restarted`
The skill directs component-level log retrieval with doctl. This is a real external command risk because logs may disclose sensitive runtime details.
Medium
Ruby/shell backtick execution
- Run `npm run build`
The skill tells agents to run a project build command. Build scripts can execute project code and dependency lifecycle behavior.
Medium
Ruby/shell backtick execution
**Fix**: `npm install <module>`
The skill recommends installing a missing module. Installing arbitrary packages creates supply-chain and local project modification risk.
Risk Factors
⚙️ External commands (13)
🔑 Env variables (5)
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/cleanexpo-deployment-audit-skill/audits/9?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/cleanexpo-deployment-audit-skill?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/cleanexpo-deployment-audit-skill?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/cleanexpo-deployment-audit-skill/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/cleanexpo-deployment-audit-skill.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
CleanExpo. (2026). deployment-audit-skill security audit report (audit version 9) [Author version unspecified]. Skillstore. https://skillstore.io/skills/cleanexpo-deployment-audit-skill/audits/9BibTeX citation
@techreport{cleanexpo-cleanexpo-deployment-audit-skill-2026,
author = {CleanExpo},
title = {deployment-audit-skill security audit report (audit version 9)},
institution = {Skillstore},
year = {2026},
number = {9},
url = {https://skillstore.io/skills/cleanexpo-deployment-audit-skill/audits/9},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "deployment-audit-skill security audit report (audit version 9)"
version: "unspecified"
type: report
authors:
- name: "CleanExpo"
date-released: "2026-07-05"
url: "https://skillstore.io/skills/cleanexpo-deployment-audit-skill/audits/9"
identifiers:
- type: other
value: "skillstore:cleanexpo-deployment-audit-skill:audit:9"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
70
Community
83
Spec Compliance
What You Can Build
Diagnose Production Restarts
Review recent deployment logs, crash patterns, and runtime health before choosing a fix.
Verify Release Readiness
Run build checks and validate key routes before promoting a deployment.
Track Deployment Risk
Create concise audit summaries and issue records for follow-up planning.
Try These Prompts
Check Deployment Health
Use this skill to review deployment health for the current project. Summarize availability, recent errors, and immediate risks.
Compare Environment Settings
Compare local and hosted environment variable names for mismatches. Do not reveal secret values; report only names and status.
Diagnose Build Failure
Use this skill to diagnose the latest build failure. Check build output, missing dependencies, TypeScript errors, and route compilation.
Perform Readiness Audit
Perform a full deployment readiness audit. Review logs, environment consistency, build health, runtime validation, and API health. Create a prioritized action list.
Best Practices
- Get explicit approval before reading environment files or provider settings.
- Redact secret values, tokens, personal data, and internal hostnames from all reports.
- Separate read-only checks from commands that install packages or change deployment state.
Avoid
- Do not paste raw environment values into audit summaries.
- Do not install dependencies without reviewing package source, version, and purpose.
- Do not run cloud commands against an account unless the user confirms the target project.
Frequently Asked Questions
What platforms does this skill target?
It targets DigitalOcean and Vercel deployments for projects that follow Synthex or Unite-Hub conventions.
Does it fix deployment issues automatically?
No. It guides diagnosis and recommends fixes, but changes should require user approval.
Can it read secret values?
It can lead an agent toward secret-bearing settings. Users should require redaction and report only variable names.
Does it require provider access?
Yes. Log retrieval and hosted setting checks require authenticated provider access.
What reports can it produce?
It can produce a deployment health summary and issue entries for audit tracking.
Is it useful outside Synthex or Unite-Hub?
Partly. The workflow is reusable, but names and expected settings are project-specific.