gitops-repo-audit

Audit local Flux GitOps repositories and generate a prioritized report.

204|10|Updated Feb 21, 2026

Search Tags:#security #validation #audit #yaml #gitops #flux

Ready to run

npx skills add https://github.com/fluxcd/agent-skills --skill gitops-repo-audit

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: gitops-repo-audit
Source: https://github.com/fluxcd/agent-skills/tree/main/skills/gitops-repo-audit
Command: npx skills add https://github.com/fluxcd/agent-skills --skill gitops-repo-audit

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires flux, awk, yq, kustomize, kubeconform, and includes scripts (resource) and references (resource) and assets (resource) components.

What problem does it solve?

Audit and validate Flux CD GitOps repositories by scanning local repo files (not live clusters) — runs Kubernetes schema validation, detects deprecated Flux APIs, reviews RBAC/multi-tenancy/secrets management, and produces a prioritized GitOps report. Use when users ask to audit, analyze, validate, review, or security-check a GitOps repo.

Core Features & Use Cases

Discovery and inventory of Flux resources in the repository using bundled scripts.
Kubernetes manifest validation and API compliance checks with kubeconform/yq/kustomize.
Security and best-practices assessment guided by Flux references (security-audit.md, best-practices.md) and API migration guidance.
Generate a structured, prioritized report that can guide remediation and governance.

Quick Start

Audit a Flux GitOps repository to produce a prioritized GitOps report.

Frequently Asked Questions about gitops-repo-audit

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I audit a Flux GitOps repository for deprecated APIs and security issues?▼

Auditing a Flux GitOps repository involves scanning local files to validate Kubernetes manifests, detect deprecated Flux APIs, review RBAC and multi-tenancy, and generate a prioritized remediation report for governance.

What is the best way to validate Kubernetes YAML manifests in a local GitOps repo?▼

The best way to validate Kubernetes YAML manifests in a local GitOps repo uses kubeconform and yq to verify syntax, enforce schema conformance, and check API compliance without connecting to a live cluster.

Can I review RBAC and multi-tenancy configurations without connecting to a live cluster?▼

You can review RBAC and multi-tenancy configurations without connecting to a live cluster by analyzing local Git repository files containing Flux manifests to assess security posture directly from source.

Does this audit work with monorepo and fleet-style Flux setups?▼

This audit works with monorepo and fleet-style setups by discovering and inventorying Flux resources like GitRepository, OCIRepository, and HelmRelease across local repository structures for validation.

Do I need kustomize and kubeconform installed to validate Flux manifests?▼

You need kustomize and kubeconform installed to validate Flux manifests; these dependencies execute Kubernetes schema conformance checks alongside yq and awk for YAML syntax processing and resource discovery.

What limitations exist when scanning local Git repositories for Flux security posture?▼

Scanning local Git repositories for Flux security posture is limited to static file analysis, meaning it does not validate runtime states or live cluster configurations, focusing solely on repository manifests.