audit-portability

Audit codebases for ISO/IEC 25010 portability issues like hardcoded paths, config-in-code, and vendor lock-in.

11|1|Updated Jul 25, 2025

Search Tags:#code analysis #audit #migration #12-factor #portability #vendor lock-in #iso 25010

Ready to run

npx skills add https://github.com/tomzx/agents --skill audit-portability-tomzx

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: audit-portability
Source: https://github.com/tomzx/agents/tree/main/skills/audit-portability
Command: npx skills add https://github.com/tomzx/agents --skill audit-portability-tomzx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? Software often accumulates hidden environment assumptions—hardcoded paths, baked-in credentials, scattered cloud SDK calls—that make it hard to run elsewhere, install cleanly, or migrate off a provider. This Skill systematically finds those portability blockers and produces a severity-classified findings report. ## Core Features & Use Cases - Adaptability Scanning: Detects hardcoded absolute paths, hostnames, IPs, OS-specific code, and 12-factor config violations using ripgrep patterns. - Installability Checks: Verifies containerization, install docs, and declared runtime versions in package manifests. - Replaceability Analysis: Counts direct cloud/provider SDK call sites to quantify vendor lock-in and checks for OpenAPI schemas and standard data export paths. - Use Case: Before migrating cloud providers, run the audit to quantify lock-in per provider and scope the migration effort with evidence-backed findings. ## Quick Start Run a portability audit on this repository and report hardcoded paths, config violations, and vendor lock-in by severity.

Frequently Asked Questions about audit-portability

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit my codebase for vendor lock-in?▼

Scan for direct cloud SDK usage like boto3, google.cloud, azure, or stripe across modules and count call sites per provider. A provider used directly in many modules indicates deep lock-in, while usage behind a single interface or adapter is acceptable.

How to check if my project follows 12-factor config principles?▼

Search for hardcoded credentials, connection strings, and URLs assigned as string literals in code, excluding reads from os.environ, getenv, or process.env. Values baked into source rather than environment variables violate the 12-factor config principle.

What is the difference between portability and compatibility in ISO/IEC 25010?▼

Portability covers adaptability, installability, and replaceability—running in a different environment and being replaceable. Compatibility covers co-existence and interoperability—running alongside other software and speaking standards.

Does the portability audit modify my code?▼

No, the audit is read-only and leaves no artifacts in the repository. Decisive findings are verified by running scratch scripts under /tmp, never by writing files into the project.

What makes a portability finding critical versus low severity?▼

Critical findings include hardcoded production credentials or data locked in proprietary formats with no export. Low severity covers optional platform-specific dependencies and minor config-in-code issues.