config-sec

Name: config-sec
Availability: InStock
Author: Q16G

Audit YAML, JSON, INI, and environment variable configurations for secrets and insecure settings.

83|8|Updated May 6, 2026

Search Tags:#hardening #secret-detection #security-headers #config-security #dangerous-config

Ready to run

npx skills add https://github.com/Q16G/aster --skill config-sec

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: config-sec
Source: https://github.com/Q16G/aster/tree/main/skills/code-audit/config-sec
Command: npx skills add https://github.com/Q16G/aster --skill config-sec

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

配置安全是保障应用防护的关键。本技能提供系统化的配置检查清单，帮助团队在代码与部署配置中快速发现敏感信息、错误的安全头设置与危险配置，从而降低泄露与攻击面。

Core Features & Use Cases

自动化敏感信息检测：对配置文件和环境变量进行全量审计，发现硬编码凭据、密钥与令牌。
安全头与 CSP 审计：检查响应头、CSP、Referrer-Policy 等配置的安全性与兼容性。
危险配置识别与修正：针对框架/语言的常见危险设置给出可执行清单与修改建议。

Use Case: 在新项目中确保不会泄露密钥、不会暴露服务器信息、并确保默认设置的安全性，可以通过此清单进行自检和修复。

Quick Start

Run config-sec against your project’s configuration files to detect secrets, insecure headers, and dangerous settings and produce a prioritized remediation list.

Frequently Asked Questions about config-sec

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I scan project configuration files for hardcoded secrets and credentials?▼

To scan configuration files for hardcoded secrets, audit YAML, JSON, INI, and environment variable configurations to detect hardcoded credentials, keys, and tokens. This process inventories project configurations to identify sensitive information and reduce potential attack surfaces.

What is security header validation for project configuration files?▼

Security header validation is the process of checking response headers, Content Security Policy, and Referrer-Policy configurations for security and compatibility. It ensures your project configurations enforce secure defaults and prevent unauthorized information exposure.

How do I identify dangerous settings in my YAML and JSON configurations?▼

Identify dangerous settings in YAML and JSON configurations by running a risk-based configuration review against framework-specific common dangerous settings. This generates an actionable checklist with modification suggestions to harden insecure default configurations.

Can I audit environment variables for insecure settings and secret detection?▼

Yes, you can audit environment variables for insecure settings and secret detection. The configuration security audit performs a full inventory of environment variable configurations to find hardcoded credentials and ensure secure defaults are applied.

What is the best way to harden project configuration security before deployment?▼

The best way to harden project configuration security is running a systematic configuration audit to detect secrets, validate security headers, and identify dangerous settings. This produces a prioritized remediation list to fix risks before deployment.

Does config-sec work with INI files to detect dangerous configuration settings?▼

Yes, config-sec works with INI files to detect dangerous configuration settings. It audits and inventories INI, YAML, JSON, and environment variable configurations to identify insecure headers and dangerous framework settings using modular sub-skills.