القائمة
Use when reviewing a `helm diff upgrade` or ArgoCD diff output before applying a Kubernetes release, or "/helm-diff". Flags destructive changes, image rollbacks, and risky manifest mutations.
التثبيت باستخدام Codex أو Claude انسخ هذا Prompt والصقه في Codex أو Claude أو مساعد آخر ليراجع صفحة Skill ويثبّتها لك.
استنادا إلى تصنيف SOC المهني
Use when reviewing a backend HTTP / GraphQL handler for validation, authz, errors, performance, observability, and security, or "/backend-review". Produces a structured review with file:line citations.
Use when running a cloud security posture scan (CSPM) on AWS, Azure, or GCP using prowler, scout-suite, or checkov, or "/cloud-scan". Requires read-only credentials; produces CIS-benchmark-aligned findings with remediation.
Use when scanning a container image or Dockerfile for vulnerabilities, misconfigurations, and best-practice violations using trivy, dockle, or hadolint, or "/image-scan". Flags base-image CVEs, root user, missing healthchecks, and bloat.
Use when running an authorized non-intrusive DAST baseline scan (OWASP ZAP baseline, nuclei, nikto) against a web app or API endpoint you own, or "/dast". Requires explicit authorization; refuses unowned targets.
Use when handed a stack trace, error log, or "this is broken" with a paste of output, and asked to find the root cause across frontend, backend, or DB tiers, or "/debug-trace". Produces a hypothesis tree, the evidence supporting each branch, and the next diagnostic step.
Use when scanning a project's third-party dependencies for known CVEs across npm, pip, Go, Maven, Cargo, etc., or "/dep-scan". Runs trivy, npm audit, pip-audit, govulncheck, or osv-scanner and produces a prioritized fix list.
| name | helm-diff-review |
| description | Use when reviewing a `helm diff upgrade` or ArgoCD diff output before applying a Kubernetes release, or "/helm-diff". Flags destructive changes, image rollbacks, and risky manifest mutations. |
| tools | ["cursor","claude","copilot"] |
helm diff upgrade <release> <chart> output, OR an argocd app diff <app> output, OR kubectl diff -f output.Parse the diff. Group changes by Kubernetes kind and name. Note adds (+), removes (-), and modifications.
Categorize changes by risk:
| Change | Risk |
|---|---|
New Deployment / StatefulSet / Job / CronJob | low–medium |
Image tag update on Deployment | medium (verify it's a roll-forward, not rollback) |
replicas change | low (scale-up) / medium (scale-down) |
resources (requests/limits) change | medium (eviction / scheduling) |
livenessProbe / readinessProbe change | medium (rollout stalls) |
Service type change (ClusterIP ↔ LoadBalancer ↔ NodePort) | HIGH (public exposure) |
Service selector change | HIGH (silent traffic loss) |
Ingress host / TLS change | HIGH |
PersistentVolumeClaim size or storageClass change | HIGH (data risk; some are immutable) |
StatefulSet volumeClaimTemplates change | HIGH (immutable; recreate required) |
NetworkPolicy change | HIGH (silent traffic loss) |
RoleBinding / ClusterRoleBinding add/escalation | HIGH |
ServiceAccount annotation change (IRSA / Workload Identity) | HIGH |
Secret data change | HIGH (rotate-or-break) |
ConfigMap change consumed via env (no rolling update trigger) | medium (won't propagate without restart) |
CRD schema change | HIGH (cluster-wide blast radius) |
Resource removal (- Deployment / Service / PVC) | HIGH |
Verify image direction. If image tag changed, check that the new tag is newer / has a higher build number. A "downgrade" is often an unintended rollback.
Check for missing rollout triggers. ConfigMap/Secret changes mounted as files don't restart pods unless the chart adds a checksum annotation (checksum/config: …). Flag if the change won't be picked up.
Check release-level concerns:
helm.sh/hook: pre-upgrade,post-upgrade,pre-delete. Pre-upgrade hooks can mutate cluster state before the rollback window.--atomic / --wait not used? Suggest enabling.CHANGELOG.md / Chart.yaml for breaking changes.Report:
## Helm Diff Review — <release> on <context>
**Chart:** <name> <old-ver> → <new-ver>
**Verdict:** safe | needs-changes | high-risk
### High-risk changes
- `Service/api` `selector.app` changed `api` → `api-v2` — will sever traffic until pods labeled v2 exist.
- `PVC/postgres-data` storageClass changed — likely requires recreate; data loss risk.
### Medium-risk changes
- `Deployment/web` resources.limits.memory 512Mi → 256Mi — risk of OOMKill under load.
### Safe changes
- +1 NetworkPolicy `allow-monitoring`
### Recommendations
- [ ] Snapshot `pvc/postgres-data` before apply.
- [ ] Verify `api-v2` Deployment is rolled out before changing Service selector (do as two releases).
- [ ] Run `helm upgrade --atomic --wait --timeout 5m`.
- [ ] Apply during off-peak window.
helm upgrade, helm rollback, argocd app sync, or kubectl apply — analysis only.kind rather than listing every object.kubectl config current-context if the user includes a context — confirm intended cluster before reviewing prod-impacting diffs.+ / - markers), ask for helm diff instead of plain template diff.