production-audit
Audit a shipped repo for production-readiness gaps across RLS, webhooks, secrets, grants, Stripe idempotency, mobile UX, and deployment health.
Profile →npx skills add sickn33/agentic-awesome-skills --skill production-audit --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
# Production Audit ## Overview A skill that runs an external audit on a shipped repo's deployed state — live URL, GitHub signals, secrets exposure, RLS gaps, webhook idempotency, indexes, observability, prompt injection, and ten other failure modes that AI-assisted projects routinely miss. This is **complementary** to in-session security skills (`security-review`, OWASP-style, VibeSec, Trail of Bits). Those scan the editor buffer at write-time. This scans the deployed product after you commit. Different timing, different inputs, different findings. Run both for serious launches. The skill wraps the [commit.show](https://commit.show) audit engine via the public CLI (`npx commitshow@0.3.23 audit . --json`). Stable JSON envelope (`schema_version: "1"`, additive-only). Writes a `.commitshow/audit.{md,json}` sidecar so future agent sessions can read prior state without re-running the engine. ## When to Use This Skill - Use when the user asks "is this production-ready", "what would break in prod", "score my project", "what did I miss", "audit my repo", "ready to ship". - Use right after merging a feature branch to `main` (helpful as a pre-deploy gate). - Use before a public launch / Show
- Overview
- When to Use This Skill
- Skip when
- How It Works
- Step 1: Run the audit
- Step 2: Parse the envelope
- Step 3: Surface to the user
- Step 4: If the user picks a concern, scope a fix
- Examples
- Example 1: User asks "is this production-ready?"
- Example 2: Cross-check a specific concern
- Best Practices
- Limitations
- Security & Safety Notes
mkdir -p .commitshow npx commitshow@0.3.23 audit . --json \ npx commitshow@0.3.23 audit github.com/owner/repo --json \ npx commitshow@0.3.23 audit . --json --refresh \ cat .commitshow/audit.json | jq '.concerns[] | select(.axis=="Infrastructure")'
What does the production-audit skill do?
Audit a shipped repo for production-readiness gaps across RLS, webhooks, secrets, grants, Stripe idempotency, mobile UX, and deployment health.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill production-audit --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.