Works with the AI tools you already use
Claude Code
Cursor
Codex CLI
Muse
Dots+22 moreClaude CodeCursorCodex CLIMuseDots
OpenClaw
Manus
Grok
Grok Bot+18 agentsLaunchguard Production Auditor
Automated production readiness auditor for software projects with evidence-based scoring and remediation plans.
$11
Launchguard Production Auditor
Example session with this skill installed
Audit the attached Node.js/Postgres repository for production readiness. We plan to deploy to AWS via Docker next week. Give me a full report and a verdict.
- Read your context and instructions
- Compiled the launchguard production auditor
- Generated the document
I have completed the production readiness audit for the project. The stack is identified as a Node.js (Express) API using TypeORM with PostgreSQL, targeting a Dockerized deployment.
Verdict: NO-GO
Readiness Score: 62/100
Top Blockers
- LG-SEC-01 (CRITICAL): Hardcoded PostgreSQL password in
src/config/database.ts. - LG-MIG-03 (HIGH): Destructive
DROP COLUMNin migration16928340-update-users.sqlwithout data backup. - LG-ENV-02 (HIGH): Missing validation for
JWT_SECRETwhich will cause runtime crashes if not set.
Audit Findings
| ID | Domain | Severity | Location | Summary |
|---|---|---|---|---|
| LG-SEC-01 | Secrets | CRITICAL | src/config/database.ts:12 | Hardcoded DB password dbpa****(12 chars). |
| LG-MIG-03 | Migrations | HIGH | migrations/*.sql | Destructive schema change on the users table. |
| LG-ENV-02 | Environment | HIGH | src/index.ts:5 | Startup does not check for required JWT env vars. |
| LG-HLT-01 | Health | MEDIUM | project-wide | Missing /healthz or liveness probes for Docker. |
| LG-CFG-01 | Config | LOW | package.json | Start script uses nodemon instead of node. |
Per-Domain Results
- Auth & Authorization: PASS. Routes use Passport.js middleware correctly.
- API Error Handling: PASS. Centralized error handler prevents stack trace leaks.
- Logging: CONDITIONAL. Console logging used; recommend structured JSON for CloudWatch.
- Backup & Rollback: FAIL. No rollback scripts detected in the migration directory.
Next steps
- Rotate the compromised PostgreSQL password immediately at the database level.
- Wrap the
DROP COLUMNmigration in a transaction with a pre-migration data export task. - Implement a startup validation script for all environment variables using a schema library like Zod.
launchguard-production-auditor.pdf
PDF · document
Example file from a real run - the skill writes it into your workspace.
Connects securely to your tools. The creator never sees your data.
What you get
About this skill
Software projects fail in production because of environment mismatches, leaked secrets, and destructive migrations. This skill acts as a senior release engineer to audit your codebase for launch risks before your users find them. It delivers an evidence-based verdict backed by a prioritized remediation plan.
What it does
Secrets detection identifies hardcoded credentials, API keys, and connection strings with masked evidence.
Production readiness scoring calculates a GO, CONDITIONAL GO, or NO-GO verdict based on critical and high-severity risks.
Migration safety analysis flags destructive database operations that cause downtime or data loss during deployment.
Environment validation maps required variables against your configuration to find missing production keys.
Infrastructure audit reviews Dockerfiles, CI/CD configs, and manifest files for insecure defaults and dev-only settings.
How it works
Scope detection identifies your framework, database, and hosting target from the project tree. Automated pre-scan searches for leads across secrets, dependencies, and build scripts. Deep domain audit evaluates the project against 12 risk domains including Auth, API handling, and Observability. Verdict delivery generates a structured report with prioritized fixes and verification steps.
Frameworks & tools
Works with any stack including Node.js, Next.js, Python, Go, and Rust. It understands deployment targets like Docker, Kubernetes, Vercel, AWS Lambda, and Fly.io.
Why this beats prompting it yourself
Generic prompts miss framework-specific edge cases like Next.js public environment variable leaking or non-idempotent SQL migrations. This skill follows a rigorous 12-domain checklist and scoring system that prevents "hallucinated" readiness.
Use cases
Auditing a repository before a major version release to production.
Reviewing a junior developer's PR for security gaps and hardcoded mocks.
Generating a production-readiness report for stakeholders or compliance needs.
Hardening a Dockerized application against root-user and open-port vulnerabilities.
Known limitations
Cannot verify external cloud provider settings, DNS records, or secrets manager contents not present in the repository. Does not execute code or perform live penetration testing.
How to install
Works the same in every agent - Claude, Cursor, Codex, Copilot and 20+ more.
- 1
Download the ZIP
Free skills download straight away. Paid skills unlock right after purchase.
- 2
Unzip into your skills folder
Every agent reads skills from one folder on your machine. Drop the unzipped folder in there.
- 3
Ask your agent to use it
Restart the agent if it was already running. It picks the skill up automatically - no config needed.
Skills folder by agent
Click the path to copy it. Create the folder if it does not exist yet.
Reviews
No reviews yet
Be one of the first to try it. Every listed skill passes our trust checks below.
Security scanned
Passed our 8-point scan before listing
Fresh listing
Recently published to Agensi
30-day refund
Not a fit? Get your money back
Trust & safety
Security scanned
Verified clean 2 days ago
- Passed all security checks, Safe to install