菜单
Review an ansible.cfg and produce a structured severity report grouped by CRITICAL, WARNING, and INFO. Triggered by /review-conf. Checks for deprecated settings, insecure values, missing critical sections, and vault misconfiguration. NEVER modifies files.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
AI-assisted Ansible authoring toolkit for Claude Code. Scaffolds, reviews, and updates playbooks, roles, collections, and ansible.cfg files following production best practices. Sub-commands: new-playbook, review-playbook, update-playbook, new-role, review-role, update-role, new-collection, review-collection, update-collection, new-conf, review-conf, update-conf. Runs discovery (CLAUDE.md to ansible.cfg to README to filesystem) at the start of every command.
Scaffold a new Ansible collection. Triggered by /new-collection. Collects collection_path, namespace, and collection name, then generates galaxy.yml, README.md, CHANGELOG.md, LICENSE, meta/runtime.yml, plugin skeletons (module, filter, lookup), roles directory, playbooks directory, and docs structure. Shows summary before writing.
Generate an annotated ansible.cfg for a specific environment. Triggered by /new-conf. Asks for target environment (dev, CI, or AWX) and generates a fully annotated ansible.cfg covering all official sections including defaults, privilege escalation, SSH connection, vault config, callback plugins, and fact caching. Shows summary before writing.
Create a new Ansible playbook. Triggered by /new-playbook. Runs discovery to find existing roles and collections, then collects path, filename, target hosts/groups, and roles to include. Generates a complete playbook with header, vars block, pre/post tasks, roles section, error handling, and tags. Shows summary before writing. Never overwrites existing files without confirmation.
Scaffold a complete Ansible role. Triggered by /new-role. Resolves role location from FQCN or path, asks whether multi-OS support is needed (RHEL, Solaris, Windows/WinRM), and generates a full role directory structure with realistic starter tasks, handlers, defaults, meta/main.yml, and OS-specific var files if requested. Shows summary before writing.
Review an existing Ansible collection and produce a structured severity report grouped by CRITICAL, WARNING, and INFO. Triggered by /review-collection. Checks galaxy.yml completeness, directory structure, required files, meta/runtime.yml, and role quality. NEVER modifies files.
| name | review-conf |
| description | Review an ansible.cfg and produce a structured severity report grouped by CRITICAL, WARNING, and INFO. Triggered by /review-conf. Checks for deprecated settings, insecure values, missing critical sections, and vault misconfiguration. NEVER modifies files. |
Review an ansible.cfg and produce a structured severity report. This command never modifies files.
Run discovery per references/discovery.md. Locate the ansible.cfg. Report which file will be reviewed.
Read and parse the ansible.cfg as an INI file. Identify all sections and key-value pairs.
## ansible.cfg Review: <path>
Reviewed: <timestamp>
Sections found: <list>
---
### CRITICAL
[Critical issues]
### WARNING
[Warnings]
### INFO
[Informational notes]
---
Summary: <X> critical, <Y> warnings, <Z> info
| Check | Condition | Message |
|---|---|---|
| vault_password_file world-readable | vault_password_file path exists and is readable by others (check permissions) | [defaults] vault_password_file '<path>' may be world-readable — run: chmod 600 <path> |
| Inline vault password | vault_identity_list contains an inline password (not a file path) | [defaults] vault_identity_list contains what appears to be an inline password — use a file path instead |
| Deprecated accelerate | [accelerate] section present (removed in ansible-core 2.12) | [accelerate] Section removed in ansible-core 2.12 — remove this section entirely |
| forks extremely high | forks > 200 | [defaults] forks=<N> is dangerously high — each fork uses ~100MB RAM, risking OOM on controller |
| log_path world-writable | log_path is set to a world-writable directory (e.g., /tmp/ansible.log without restriction) | [defaults] log_path '<path>' is in a world-writable directory — logs may contain sensitive data |
| Check | Condition | Message |
|---|---|---|
| host_key_checking=False without comment | host_key_checking = False with no inline comment justifying it | [defaults] host_key_checking=False without justification comment — add a comment explaining the context (dev/CI/ephemeral runners) |
| Missing [privilege_escalation] | become = True set in [defaults] but no [privilege_escalation] section | [defaults] become=True is set but [privilege_escalation] section is absent — add the section for explicit configuration |
| Callbacks include awx_display manually | callbacks_enabled contains awx_display | [defaults] Do not add awx_display to callbacks_enabled — AWX injects it automatically and adding it causes duplicate output |
| fact_caching_connection has credentials | fact_caching_connection contains a password in the URL (redis://:password@...) | [defaults] fact_caching_connection contains credentials in plaintext — use an environment variable or vault-encrypted value |
| stdout_callback=debug | stdout_callback = debug | [defaults] stdout_callback=debug produces very verbose output — use yaml or minimal for normal operation |
| retry_files_enabled=True | retry_files_enabled = True (the default) | [defaults] retry_files_enabled is True (default) — consider setting to False to reduce filesystem noise |
| Deprecated squash_actions | squash_actions key present | [defaults] squash_actions was removed in ansible-core 2.8 — remove this setting |
| Deprecated any_errors_fatal at cfg level | any_errors_fatal in ansible.cfg (not a valid ansible.cfg setting) | [defaults] any_errors_fatal belongs in playbooks, not ansible.cfg |
| Missing collections_path | local collections exist but no collection path is configured | [defaults] ./collections/ directory exists but collections_path is not configured — add collections_path = ./collections |
| pipelining disabled | pipelining = False or not set | [ssh_connection] pipelining is disabled — enable it for significant performance improvement (requires Defaults:!requiretty in /etc/sudoers) |
| Check | Condition | Message |
|---|---|---|
| gathering=implicit | gathering = implicit (not smart) | [defaults] gathering=implicit re-gathers facts on every play — consider smart to use cached facts |
| forks at default | forks not set or = 5 | [defaults] forks defaults to 5 — increase for large inventories (e.g., forks=20) |
| No fact caching configured | fact_caching not set | [defaults] Fact caching not configured — consider jsonfile or redis for faster reruns |
| log_path not set | log_path absent | [defaults] log_path not set — consider enabling for audit trail (rotate with logrotate) |
| No vault config | Neither vault_password_file nor vault_identity_list is set | [defaults] No vault configuration — add vault_password_file or vault_identity_list if using ansible-vault |
| control_persist not set | control_persist absent | [ssh_connection] control_persist not set — add control_persist=60s for connection reuse |
/ansible-designer:update-conf to apply fixes."