About

Imported from shipshitdev/skills (skills/production-audit/SKILL.md). Install upstream with npx skills add shipshitdev/skills --skill production-audit. Copyright stays with the author.

Production Audit

Name: production-audit
Author: shipshitdev

Assess whether an application is safe to ship by inspecting the release surface and naming production risks.

Contract

Inputs:

Repository, branch, PR, release candidate, or deployed URL
Optional launch-critical flows, test account, environment notes, or CI run

Outputs:

Ship/block recommendation with score and evidence
Blockers, high-value fixes, missing evidence, and next action
Concrete file, command, CI, or URL references

Creates/Modifies:

None in audit mode
Follow-up fixes only when explicitly requested

External Side Effects:

Read-only local commands and authorized HTTP/browser checks
No source upload, destructive migration, production write, or scanner run by default

Confirmation Required:

Before credentialed production actions, remote scanner use, deploys, migrations, data changes, or user-impacting tests

Delegates To:

security-audit for application security findings
deploy or deployment-composer for release mechanics
release-pr-gates for GitHub release promotion
playwright-e2e-init for missing launch-critical browser coverage; test-runner for existing tests

When to Use

User asks "is this production ready?", "what breaks in prod?", "ready to ship?", "audit this release", or "what did we miss?"
A launch, demo, customer rollout, or investor walkthrough is close.
CI is green but production risk still needs review.
A risky PR merged or a dependency upgrade landed.
A deployed staging or preview URL needs a readiness pass.

Not a compliance, legal, financial, medical, or security certification — engineering release triage only.

Evidence Order

Start with cheap local evidence:

git status --short --branch
git log --oneline --decorate -20
git diff --stat origin/main...HEAD

Then inspect the surfaces that actually exist:

package scripts, build commands, CI workflows, and release scripts
API routes, auth middleware, webhooks, workers, cron jobs, and queues
migrations, seeds, backfills, rollback notes, and data access policies
environment variable documentation and startup validation
payment, email, storage, AI, and external-provider boundaries
observability, logging, health checks, dashboards, and alert ownership
E2E or smoke coverage for launch-critical user paths
deployed URL checks when a URL is in scope

Do not call a release healthy just because CI is green.

Risk Lenses

Security and Auth

Are sensitive routes protected server-side?
Are authorization checks tenant-aware and applied near data access?
Are secrets absent from client bundles, logs, examples, and committed files?
Are uploads, CORS, CSRF, rate limits, and input validation appropriate?
Do agent or AI surfaces isolate untrusted content from privileged tools?

Data Integrity

Can migrations run forward safely?
Is there a rollback, recovery, or backup path for high-impact changes?
Are destructive backfills staged and idempotent?
Are retries safe for writes, jobs, and webhooks?
Do sandbox, staging, and production schemas match the code assumptions?

Payments and Webhooks

Are webhook signatures verified before trusting payload fields?
Are fulfillment handlers idempotent for duplicate delivery?
Are out-of-order and replayed events handled?
Are test and live credentials separated?
Is customer-visible billing state recoverable after provider failure?

Operations

Can the app start from a clean checkout with documented commands?
Are required environment variables named and validated at startup?
Is there a health check that proves dependencies are reachable?
Are logs useful without leaking secrets or personal data?
Is there a clear deploy, rollback, and incident-owner path?

User Experience

Are launch-critical paths covered on desktop and mobile?
Are loading, empty, error, and permission-denied states usable?
Do forms handle invalid input, slow requests, and double submits?
Is there a recovery or support path when a critical operation fails?

Scoring

Use scores to force prioritization:

Score	Verdict
0-49	Blocked: do not ship until blockers are fixed
50-69	Risky: internal beta or small rollout only
70-84	Launchable with caveats: ship if owners accept named risks
85-100	Strong: no obvious launch blockers from available evidence

Cap at 69 if any are true:

auth or authorization is missing for sensitive data
payment or fulfillment webhooks are not idempotent
required migrations cannot run safely
secrets are exposed in client bundles, logs, or committed files
no rollback or recovery path exists for a high-impact release

Cap at 84 if CI is not green or the launch-critical path was not tested end to end.

Output Format

Lead with one sentence:

Production audit: 76/100, launchable with caveats, with webhook idempotency and rollback docs as the two risks to fix before public launch.

Then list:

Blockers: must-fix items before deploy
High-value fixes: next improvements by impact
Evidence checked: files, commands, CI, URLs, or PRs inspected
Evidence missing: what would change confidence
Next action: one concrete fix or verification step

If no blockers are found, still state the evidence boundary.

Anti-Patterns

Running unpinned remote scanners as the default audit path.
Uploading private source, secrets, customer data, or topology externally without explicit approval.
Giving a score without naming evidence.
Treating staging smoke tests as proof that data migrations are safe.
Ending with a generic summary instead of the next concrete release action.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/shipshitdev-skills-production-audit/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

shipshitdev-skills-production-audit.ocm.jsonjson

{
  "ocm": "1",
  "id": "shipshitdev-skills-production-audit",
  "kind": "skill",
  "name": "production-audit",
  "description": "Audit an application for production readiness using local evidence from code, CI, config, migrations, runtime checks, observability, and deployment paths. Use before launch, after risky merges, or when asked whether an app is ready to ship.",
  "publisher": "shipshitdev",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "production",
      "audit",
      "launch",
      "deployment",
      "reliability",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Audit an application for production readiness using local evidence from code, CI, config, migrations, runtime checks, observability, and deployment paths. Use before launch, after risky merges, or when asked whether an app is ready to ship."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/shipshitdev/skills",
      "path": "skills/production-audit/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/shipshitdev/skills/blob/HEAD/skills/production-audit/SKILL.md",
      "key": "shipshitdev/skills/skills/production-audit/SKILL.md"
    }
  },
  "instructions": "# Production Audit\n\nAssess whether an application is safe to ship by inspecting the release surface and naming production risks.\n\n## Contract\n\nInputs:\n\n- Repository, branch, PR, release candidate, or deployed URL\n- Optional launch-critical flows, test account, environment notes, or CI run\n\nOutputs:\n\n- Ship/block recommendation with score and evidence\n- Blockers, high-value fixes, missing evidence, and next action\n- Concrete file, command, CI, or URL references\n\nCreates/Modifies:\n\n- None in audit mode\n- Follow-up fixes only when explicitly requested\n\nExternal Side Effects:\n\n- Read-only local co",
  "cost": {
    "context_tokens": 1426
  }
}

Fetch it by URL: GET /api/v1/registry/shipshitdev-skills-production-audit/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.