fluxcd-kustomization-helmrelease-review

Use this skill when reviewing FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, or OCIRepository resources. Trigger when the user asks whether a Flux configuration is safe for production, whether SOPS encryption is required, whether prune is safe on a given workload, whether commit signature verification is enabled, or whether a Flux multi-tenant setup uses least-privilege ServiceAccounts.

Ir para a instalação

Repositório: Raishin/vanguard-frontier-agentic
Última atividade na origem: 5 de maio de 2026 às 17:49
Idioma detectado do SKILL.md: inglês
Estrelas: 18
Forks: 3

Opções de instalação

Por padrão, está selecionado o prompt que primeiro revisa a origem. Você pode mudar para um comando direto ou baixar uma cópia local.

Instalar com Codex ou Claude Copie este prompt, cole no Codex, Claude ou outro assistente e deixe que ele revise a página da skill e instale para você.

Um comando direto ignora o prompt de revisão. Verifique a origem antes de executá-lo.

npx skills add https://github.com/Raishin/vanguard-frontier-agentic --skill fluxcd-kustomization-helmrelease-review

O comando permanece em uma só linha. Role horizontalmente para revisá-lo antes de copiar.

Prefere uma cópia local? Baixe os arquivos disponíveis atualmente no SkillsMP.

Revise os arquivos de origem

Leia o SKILL.md e os arquivos complementares exibidos pelo SkillsMP antes de decidir se vai instalar.

Explorador de arquivos

3 arquivos

SKILL.md

Instruções da origem · Visualização somente leitura

Voltar à pesquisa Voltar à instalação

kotlin-android-architecture

Use this skill to statically review Android app architecture correctness: ViewModel lifecycle and scoping across configuration changes, SavedStateHandle persistence across process death, lifecycle-aware Flow collection (repeatOnLifecycle/collectAsStateWithLifecycle/flowWithLifecycle), and unidirectional data flow with a single source of truth. Reads source only; it never runs or instruments the app.

2026-07-21

kotlin-android-security-privacy

Use this skill to statically review an Android app's security and privacy posture against OWASP MASVS: exported components and intent surfaces, deep-link/App Links validation, WebView exposure, cleartext traffic and network-security-config, local storage and secrets (EncryptedSharedPreferences/Keystore), backup exposure, runtime-permission minimization, and PII in logs. Reads manifest, source, and sanitized config only; it never builds, installs, or instruments an app.

2026-07-21

kotlin-library-api-abi-governance

Use this skill to statically review Kotlin library public-API evolution and binary/source compatibility for libraries consumed by both Kotlin and Java: binary-compatibility-validator .api snapshots and apiCheck gating, Explicit API mode, @JvmOverloads/@JvmStatic/@JvmName Java-facing surface shaping, and ABI-sensitive data-class and inline-function-body changes. Reads source and build configuration only; it never runs apiDump/apiCheck or publishes a release.

2026-07-21

Ver todas deste repositório

FluxCD Kustomization and HelmRelease Review

Purpose

Review FluxCD Kustomization, HelmRelease, GitRepository, HelmRepository, and OCIRepository resources for source trust guarantees, SOPS secret encryption, prune-enabled blast radius on stateful workloads, per-Kustomization ServiceAccount scoping, HelmRelease upgrade remediation safety, and health check completeness. FluxCD's default posture gives the kustomize-controller cluster-admin-equivalent reach — the security surface lives in per-Kustomization ServiceAccounts, commit signature verification, SOPS encryption at rest, and prune annotation guards.

Lean operating rules

Prefer user-provided sanitized resource YAML as primary evidence; official FluxCD docs are the authoritative fallback.

Treat unencrypted Kubernetes Secret manifests committed to any Git source as a CRITICAL finding — anyone with repo read access (CI, PR participants, auditors) has those secrets.

Treat GitRepository.spec.ref.semver: ">=0.0.0" or an unbound semver range in a production source as a HIGH finding — any tag push from a compromised upstream triggers a deploy.

Treat the absence of spec.verify.secretRef (commit GPG signature verification) on production GitRepository sources as a HIGH finding.

Treat Kustomization.spec.serviceAccountName not set as a HIGH finding — the kustomize-controller SA applies with cluster-admin-equivalent scope for all tenants.

Treat spec.prune: true on Kustomizations covering stateful workloads (StatefulSets, PVCs, CRDs) without kustomize.toolkit.fluxcd.io/prune: disabled annotations as a HIGH finding.

Treat HelmRelease.spec.chart.spec.version: "*" or an unbound version range as a HIGH finding — any upstream chart publish triggers an auto-upgrade.

Treat HelmRelease.spec.upgrade.remediation.retries: -1 (infinite retry) as a MEDIUM finding — a broken release blocks other reconciliation loops indefinitely.

Keep the answer scoped: report what was reviewed, the evidence level, and the exact field path for each finding.

References

Load these only when needed:

Response minimum

Scoped target (resource kind/name/namespace) and evidence level

Source trust verdict (commit verification, semver pinning, SOPS encryption)

Kustomization ServiceAccount scope assessment

Prune safety verdict for any stateful workloads

HelmRelease version pinning and upgrade remediation assessment

Health check completeness verdict

Safe next actions and open questions