Audit YAML, JSON, INI, and environment variable configurations for secrets and insecure settings.
npx skills add https://github.com/Q16G/aster --skill config-sec
Please help me install this Agent Skill. Skill: config-sec Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/config-sec Command: npx skills add https://github.com/Q16G/aster --skill config-sec
配置安全是保障应用防护的关键。本技能提供系统化的配置检查清单，帮助团队在代码与部署配置中快速发现敏感信息、错误的安全头设置与危险配置，从而降低泄露与攻击面。
Use Case: 在新项目中确保不会泄露密钥、不会暴露服务器信息、并确保默认设置的安全性，可以通过此清单进行自检和修复。
Run config-sec against your project’s configuration files to detect secrets, insecure headers, and dangerous settings and produce a prioritized remediation list.
High-intent search queries and answers about installing and using this skill.
To scan configuration files for hardcoded secrets, audit YAML, JSON, INI, and environment variable configurations to detect hardcoded credentials, keys, and tokens. This process inventories project configurations to identify sensitive information and reduce potential attack surfaces.
Security header validation is the process of checking response headers, Content Security Policy, and Referrer-Policy configurations for security and compatibility. It ensures your project configurations enforce secure defaults and prevent unauthorized information exposure.
Identify dangerous settings in YAML and JSON configurations by running a risk-based configuration review against framework-specific common dangerous settings. This generates an actionable checklist with modification suggestions to harden insecure default configurations.
Yes, you can audit environment variables for insecure settings and secret detection. The configuration security audit performs a full inventory of environment variable configurations to find hardcoded credentials and ensure secure defaults are applied.
The best way to harden project configuration security is running a systematic configuration audit to detect secrets, validate security headers, and identify dangerous settings. This produces a prioritized remediation list to fix risks before deployment.
Yes, config-sec works with INI files to detect dangerous configuration settings. It audits and inventories INI, YAML, JSON, and environment variable configurations to identify insecure headers and dangerous framework settings using modular sub-skills.
armanzeroeightManage Ansible inventory files in INI, YAML, and dynamic formats.
NOMARJDetect hardcoded credentials and insecure default configurations in source code and config files.
LeandroBenjaminLAutomate security audits with static and dynamic analysis tools.
PP-NamiasExecute and interpret seven security checks in CI/CD pipelines.
