fluxcd-kustomization-helmrelease-review

Use this skill when reviewing FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, or OCIRepository resources. Trigger when the user asks whether a Flux configuration is safe for production, whether SOPS encryption is required, whether prune is safe on a given workload, whether commit signature verification is enabled, or whether a Flux multi-tenant setup uses least-privilege ServiceAccounts.

Jump to install

Repository: Raishin/vanguard-frontier-agentic
Last source activity: May 5, 2026 at 17:49
Detected SKILL.md language: English
Stars: 18
Forks: 3

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.

A direct command skips the review prompt. Inspect the source before running it.

npx skills add https://github.com/Raishin/vanguard-frontier-agentic --skill fluxcd-kustomization-helmrelease-review

The command stays on one line. Scroll horizontally to inspect it before copying.

Prefer a local copy? Download the files currently available to SkillsMP.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

File Explorer

3 files

SKILL.md

Source instructions · Read-only preview

Back to search Back to installation

kotlin-android-architecture

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

2026-07-21

kotlin-android-security-privacy

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

2026-07-21

kotlin-library-api-abi-governance

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

2026-07-21

View all from this repository

FluxCD Kustomization and HelmRelease Review

Purpose

Review FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, and OCIRepository resources for source trust guarantees, SOPS secret encryption, prune-enabled blast radius on stateful workloads, per-Kustomization ServiceAccount scoping, HelmRelease upgrade remediation safety, and health check completeness. FluxCD's default posture gives the kustomize-controller cluster-admin-equivalent reach — the security surface lives in per-Kustomization ServiceAccounts, commit signature verification, SOPS encryption at rest, and prune annotation guards.

Lean operating rules

Prefer user-provided sanitized resource YAML as primary evidence; official FluxCD docs are the authoritative fallback.

Treat unencrypted Kubernetes Secret manifests committed to any Git source as a CRITICAL finding — anyone with repo read access (CI, PR participants, auditors) has those secrets.

Treat GitRepository.spec.ref.semver: ">=0.0.0" or an unbound semver range in a production source as a HIGH finding — any tag push from a compromised upstream triggers a deploy.

Treat the absence of spec.verify.secretRef (commit GPG signature verification) on production GitRepository sources as a HIGH finding.

Treat Kustomization.spec.serviceAccountName not set as a HIGH finding — the kustomize-controller SA applies with cluster-admin-equivalent scope for all tenants.

Treat spec.prune: true on Kustomizations covering stateful workloads (StatefulSets, PVCs, CRDs) without kustomize.toolkit.fluxcd.io/prune: disabled annotations as a HIGH finding.

Treat HelmRelease.spec.chart.spec.version: "*" or an unbound version range as a HIGH finding — any upstream chart publish triggers an auto-upgrade.

Treat HelmRelease.spec.upgrade.remediation.retries: -1 (infinite retry) as a MEDIUM finding — a broken release blocks other reconciliation loops indefinitely.

Keep the answer scoped: report what was reviewed, the evidence level, and the exact field path for each finding.

References

Load these only when needed:

Response minimum

Scoped target (resource kind/name/namespace) and evidence level

Source trust verdict (commit verification, semver pinning, SOPS encryption)

Kustomization ServiceAccount scope assessment

Prune safety verdict for any stateful workloads

HelmRelease version pinning and upgrade remediation assessment

Health check completeness verdict

Safe next actions and open questions