fluxcd-kustomization-helmrelease-review

Use this skill when reviewing FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, or OCIRepository resources. Trigger when the user asks whether a Flux configuration is safe for production, whether SOPS encryption is required, whether prune is safe on a given workload, whether commit signature verification is enabled, or whether a Flux multi-tenant setup uses least-privilege ServiceAccounts.

Ir a la instalación

Repositorio: Raishin/vanguard-frontier-agentic
Última actividad en el origen: 5 de mayo de 2026 a las 17:49
Idioma detectado de SKILL.md: inglés
Estrellas: 18
Forks: 3

Opciones de instalación

De forma predeterminada está seleccionado el prompt que primero revisa el origen. Puedes cambiar a un comando directo o descargar una copia local.

Instalar con Codex o Claude Copia este prompt, pégalo en Codex, Claude u otro asistente, y deja que revise la página de la skill y la instale por ti.

Un comando directo omite el prompt de revisión. Revisa el origen antes de ejecutarlo.

npx skills add https://github.com/Raishin/vanguard-frontier-agentic --skill fluxcd-kustomization-helmrelease-review

El comando permanece en una sola línea. Desplázate horizontalmente para revisarlo antes de copiarlo.

¿Prefieres una copia local? Descarga los archivos que SkillsMP tiene disponibles ahora.

Revisa los archivos de origen

Lee SKILL.md y los archivos complementarios que muestra SkillsMP antes de decidir si quieres instalarlo.

Explorador de archivos

3 archivos

SKILL.md

Instrucciones de origen · Vista previa de solo lectura

Volver a la búsqueda Volver a la instalación

kotlin-android-architecture

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

2026-07-21

kotlin-android-security-privacy

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

2026-07-21

kotlin-library-api-abi-governance

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

2026-07-21

Ver todos los de este repositorio

FluxCD Kustomization and HelmRelease Review

Purpose

Review FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, and OCIRepository resources for source trust guarantees, SOPS secret encryption, prune-enabled blast radius on stateful workloads, per-Kustomization ServiceAccount scoping, HelmRelease upgrade remediation safety, and health check completeness. FluxCD's default posture gives the kustomize-controller cluster-admin-equivalent reach — the security surface lives in per-Kustomization ServiceAccounts, commit signature verification, SOPS encryption at rest, and prune annotation guards.

Lean operating rules

Prefer user-provided sanitized resource YAML as primary evidence; official FluxCD docs are the authoritative fallback.

Treat unencrypted Kubernetes Secret manifests committed to any Git source as a CRITICAL finding — anyone with repo read access (CI, PR participants, auditors) has those secrets.

Treat GitRepository.spec.ref.semver: ">=0.0.0" or an unbound semver range in a production source as a HIGH finding — any tag push from a compromised upstream triggers a deploy.

Treat the absence of spec.verify.secretRef (commit GPG signature verification) on production GitRepository sources as a HIGH finding.

Treat Kustomization.spec.serviceAccountName not set as a HIGH finding — the kustomize-controller SA applies with cluster-admin-equivalent scope for all tenants.

Treat spec.prune: true on Kustomizations covering stateful workloads (StatefulSets, PVCs, CRDs) without kustomize.toolkit.fluxcd.io/prune: disabled annotations as a HIGH finding.

Treat HelmRelease.spec.chart.spec.version: "*" or an unbound version range as a HIGH finding — any upstream chart publish triggers an auto-upgrade.

Treat HelmRelease.spec.upgrade.remediation.retries: -1 (infinite retry) as a MEDIUM finding — a broken release blocks other reconciliation loops indefinitely.

Keep the answer scoped: report what was reviewed, the evidence level, and the exact field path for each finding.

References

Load these only when needed:

Response minimum

Scoped target (resource kind/name/namespace) and evidence level

Source trust verdict (commit verification, semver pinning, SOPS encryption)

Kustomization ServiceAccount scope assessment

Prune safety verdict for any stateful workloads

HelmRelease version pinning and upgrade remediation assessment

Health check completeness verdict

Safe next actions and open questions