菜单
Environment management conventions for all projects. Covers reproducible local development, environment parity, .env patterns, developer onboarding, and containerised development. Applied when setting up or reviewing development environments.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Scan a project for missing best-practice areas and implement the top recommendation for each gap (linting, unit testing) — installs tools, writes configs, verifies, and commits. Pass 'recommend' to stop after writing recommendations without implementing (replaces the old do-recommend skill).
Implement a focused code change. Use this skill as the wrapper for any implementation work so the Maverick workflow report captures what was done and so the agent applies the project's coding standards before editing. Intended to be invoked once per task from inside a do-issue-* or do-epic phase, not standalone.
Audit a codebase for security risks in one of two modes. In full-audit mode it scans the entire codebase and writes a findings report to docs/security-audit.md (run as part of do-init or on demand). In update mode it reviews only a diff plus the code it could impact, returning a structured findings list as a pre-push gate for do-issue-solo and do-issue-guided. Covers secrets exposure, dependency vulnerabilities, authentication and authorisation patterns, input validation, transport security, and common OWASP risks.
Create, restructure, or update technical documentation. Handles greenfield projects, refactoring non-compliant docs, and incremental updates after code changes.
Work on a multi-story GitHub epic end-to-end. Builds a DAG from the child stories, groups them into waves, runs waves in parallel via per-story worktrees, ejects PRs that fail agent-code-review for human handling, and propagates blocks to downstream stories. Requires git worktrees.
Initialise a project for use with Maverick — verifies the GitHub App, installs the CLI if needed, writes the project config with integration tracking, scaffolds docs, generates project skills, runs an initial cybersecurity audit, then commits the changes and opens a PR.
| name | mav-bp-environment-management |
| description | Environment management conventions for all projects. Covers reproducible local development, environment parity, .env patterns, developer onboarding, and containerised development. Applied when setting up or reviewing development environments. |
| user-invocable | false |
| disable-model-invocation | true |
Maverick's hard rules for reproducible local development environments and environment-specific configuration.
.node-version, .tool-versions, etc.) and container image versions (postgres:16.2, never latest).if (env === "production") is a code smell; one code path, config injected via env vars. Sole exception: a single log-verbosity/error-reporting config check at initialisation..env discipline — .env.example is committed and lists every env var the application reads, each with a description; sensitive values blank, safe defaults provided. .env is gitignored. .env.production never exists locally — production config comes from the deployment platform. Validate required env vars at startup and fail fast.127.0.0.1:5432:5432); include health checks so dependents wait for readiness..env.example format:
DATABASE_URL= # PostgreSQL connection string (e.g., postgres://user:pass@localhost:5432/mydb)
STRIPE_API_KEY= # Stripe secret key (starts with sk_test_ or sk_live_)
LOG_LEVEL=error # error | warn | debug
PORT=3000 # HTTP server port
Check for docs/maverick/skills/environment-management/SKILL.md. If present, read it — it wins on specifics (library, config, conventions). If missing, proceed with these standards and note the gap in your summary.
| Pattern | Issue | Fix |
|---|---|---|
| Hard-coded URLs, ports, or credentials in source code | Environment coupling | Extract to environment variables |
if (env === "production") logic scattered in code | Environment branching | Use configuration values, not environment names |
No .env.example but application reads env vars | Undocumented configuration | Create .env.example with all required vars |
.env file committed to repository | Credential exposure risk | Add to .gitignore, remove from history |
| No version pinning for language runtime | Non-reproducible builds | Add .node-version, .python-version, or equivalent |
docker-compose.yml using latest tags | Non-deterministic services | Pin to specific image versions |
| Setup instructions that require asking a team member | Tribal knowledge dependency | Document all steps in README or CONTRIBUTING.md |
| Database engine differs between dev and production | Environment parity violation | Use the same engine locally via Docker |
| No health checks in Docker Compose services | Startup race conditions | Add health checks and depends_on with condition |
This skill covers local/dev environments only (devcontainers, Docker Compose for local services, .env, version pinning, onboarding). Deployed environments — Terraform, CloudFormation, Kubernetes, cloud provisioning — belong to mav-bp-infrastructure-as-code. When an artifact serves both (e.g., Compose used in local dev and CI), follow both.