Run any Skill in Manus with one click

$pwd:

flexport-prod-checklist

Name: Flexport Prod Checklist
Author: jeremylongshore

// Execute Flexport production deployment checklist for logistics integrations. Use when deploying shipment tracking, booking automation, or supply chain integrations to production with proper monitoring and rollback. Trigger: "flexport production", "deploy flexport", "flexport go-live checklist".

Run Skill in Manus

$ git log --oneline --stat

stars:2,267

forks:315

updated:May 23, 2026 at 05:41

SKILL.md

readonly

name	flexport-prod-checklist
description	Execute Flexport production deployment checklist for logistics integrations. Use when deploying shipment tracking, booking automation, or supply chain integrations to production with proper monitoring and rollback. Trigger: "flexport production", "deploy flexport", "flexport go-live checklist".
allowed-tools	Read, Bash(curl:*), Grep
version	1.0.0
license	MIT
author	Jeremy Longshore <jeremy@intentsolutions.io>
tags	["saas","logistics","flexport"]
compatibility	Designed for Claude Code

Flexport Production Checklist

Overview

Pre-deployment and go-live checklist for Flexport logistics integrations covering API configuration, webhook setup, monitoring, and rollback procedures.

Pre-Deployment

Authentication & Secrets

Production API key stored in secret manager (not env files)
Webhook secret configured and verified
Key rotation procedure documented
No keys in git history (git log -p | grep -i flexport_api)

API Integration

All endpoints tested against production API
Pagination implemented for list endpoints (/shipments, /products)
Rate limit handling with exponential backoff
Retry logic for transient 5xx errors
Idempotency keys on POST/PATCH operations
Flexport-Version: 2 header on all requests

Webhooks

HTTPS endpoint with valid TLS certificate
X-Hub-Signature verification implemented
Webhook endpoint responds within 5 seconds
Dead letter queue for failed webhook processing
Idempotent webhook handlers (replay-safe)

Data Integrity

HS codes validated against customs requirements
UN/LOCODE port codes verified
Commercial invoice totals cross-checked
Product catalog synced with Flexport Product Library

Monitoring & Alerting

// Health check endpoint
app.get('/health', async (req, res) => {
  const start = Date.now();
  try {
    const r = await fetch('https://api.flexport.com/shipments?per=1', {
      headers: {
        'Authorization': `Bearer ${process.env.FLEXPORT_API_KEY}`,
        'Flexport-Version': '2',
      },
    });
    res.json({
      status: r.ok ? 'healthy' : 'degraded',
      flexport: { connected: r.ok, latencyMs: Date.now() - start },
    });
  } catch {
    res.status(503).json({ status: 'unhealthy', flexport: { connected: false } });
  }
});

Alert Thresholds

Metric	Warning	Critical
API error rate	> 5%	> 20%
p99 latency	> 3000ms	> 10000ms
429 rate limits	> 5/hour	> 20/hour
Webhook failures	> 2/hour	> 10/hour
Auth failures (401/403)	Any	Any

Rollback Procedure

# Immediate rollback
kubectl rollout undo deployment/flexport-integration
# Or for non-k8s: revert to last known good image/version

Resources

Next Steps

For version upgrades, see flexport-upgrade-migration.

related-skills.json

same repository

detecting-command-injection-patterns.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node child_process.exec with template literals, Ruby backticks / Kernel#system / Kernel#exec with interpolation, Go exec.Command with shell wrapping, PHP system / passthru / shell_exec / backticks with $-interpolation, Java Runtime.exec with concatenated args. Use when: pre-commit gate on code that calls out to shell utilities, audit of file-processing / archive-handling / image-conversion code, post-bug-report investigation for "we shell out to a tool." Threshold: any shell-invocation API called with a string that contains a variable interpolation, OR shell=True with anything other than a fixed literal. Trigger with: "scan command injection", "shell=True audit", "find exec calls", "check os.system".

2026-05-312.3k

detecting-eval-exec-usage.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input. Use when: pre-commit gate on any application that parses user-uploaded code (rule engines, formula evaluators, plugin systems), or post-bug-report when "we run user-supplied expressions." Threshold: any call to eval / exec / Function / similar where the argument is not a string literal. Trigger with: "scan eval", "find dynamic exec", "audit eval calls", "code injection patterns".

2026-05-312.3k

detecting-insecure-deserialization.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for unsafe-by-default deserialization APIs: Python pickle.loads / cPickle / shelve / dill, Ruby Marshal.load / YAML.load (pre-3.1 default), Java ObjectInputStream.readObject, PHP unserialize, .NET BinaryFormatter / NetDataContractSerializer, Node.js node-serialize, JavaScript JSON.parse with reviver containing eval. Use when: pre-commit gate on services that accept binary blobs, audit of legacy job-queue code (workers deserializing tasks), post-bug-report when "we accept user-uploaded archives." Threshold: any call to a known-unsafe deserialization API on data that originates from user input, network, file upload, or untrusted storage. Trigger with: "scan deserialization", "pickle audit", "java readObject scan", "yaml.load check".

2026-05-312.3k

detecting-sql-injection-patterns.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for SQL-injection vulnerable patterns: string concatenation into queries, f-string interpolation in SQL, string-format substitution into raw queries, deprecated cursor methods (cursor.execute with % formatting), Knex / Sequelize raw() with template interpolation, sequelize.query with replacements. Use when: pre-commit code review, post-feature SQL-touching release, inheriting a legacy codebase that predates ORMs, or post-bug-report investigation. Threshold: any source line where SQL keywords (SELECT / INSERT / UPDATE / DELETE / FROM / WHERE) appear in a string that's being built via concatenation, f-string, %-format, or .format() with variable input. Trigger with: "scan for sqli", "sql injection patterns", "check raw queries", "audit cursor.execute".

2026-05-312.3k

detecting-weak-cryptography.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source tree for weak cryptographic primitives: MD5 / SHA-1 used for security purposes, DES / 3DES / RC4 ciphers, ECB block mode, custom-built crypto (XOR loops, hand-rolled HMAC), hardcoded IVs, predictable random (Math.random / java.util.Random for crypto seeds), missing certificate verification (verify=False, rejectUnauthorized: false). Use when: pre-merge gate on crypto-touching code, audit before SOC2 / PCI assessment, post-incident review when "we found a weakness in our token signing." Threshold: any call to a known-weak algorithm with non-test context, OR cert verification explicitly disabled, OR a custom crypto loop pattern. Trigger with: "scan weak crypto", "find MD5 usage", "check ECB mode", "audit ssl verify", "weak random".

2026-05-312.3k

scanning-for-hardcoded-secrets.md

from "jeremylongshore/claude-code-plugins-plus-skills"

Scan a source-code tree for hardcoded credentials embedded in source files: AWS access keys, GitHub tokens, Stripe keys, Slack tokens, Anthropic API keys, OpenAI keys, JWT signing secrets, generic base64-encoded passwords, RSA / SSH private keys, and high-entropy string literals that pattern-match common credential shapes. Use when: pre-commit gate before pushing a feature branch, audit before SOC2, post-incident scan after a leak, or inheriting a codebase you didn't write. Threshold: any source file contains a string that matches a canonical credential regex (AWS AKIA prefix, GitHub ghp_ prefix, etc.) OR a string with Shannon entropy above 4.5 in a field context (key=, token:, secret=). Trigger with: "scan secrets", "credential scan", "find hardcoded keys", "leak check".

2026-05-312.3k

package.json

"author": "jeremylongshore"

"repository": "jeremylongshore/claude-code-plugins-plus-skills"

View GitHub Repository View Creator Repositories

$ install --global

$ download --local

Run Skill in Manus

$ useful --forSOC

Network and Computer Systems AdministratorsComputer and Mathematical Occupations15-1244L4

Run any Skill with one click

flexport-prod-checklist

Flexport Production Checklist

Overview

Pre-Deployment

Authentication & Secrets

API Integration

Webhooks

Data Integrity

Monitoring & Alerting

Alert Thresholds

Rollback Procedure

Resources

Next Steps

More from this repository

Flexport Production Checklist

Overview

Pre-Deployment

Authentication & Secrets

API Integration

Webhooks

Data Integrity

Monitoring & Alerting

Alert Thresholds

Rollback Procedure

Resources

Next Steps

More from this repository