Config Risk Reviewer

Audits configuration and infrastructure files for security flaws: hardcoded secrets, wildcard bindings (0.0.0.0), running as root, missing CPU/RAM limits, and insecure CI privileges.

1. Purpose

Prevent infrastructure misconfigurations before they reach production. A "Configuration Risk" is a setting that exposes security vulnerabilities or compromises system stability.

2. When to Use

Use this skill when:

• Reviewing Dockerfiles, Kubernetes manifests, GitHub Actions workflows, or terraform scripts.
• Checking .env.example or nginx/apache configurations.
• User asks: "Is this Dockerfile secure?" or "Review this YAML config."

3. When Not to Use

• Do not use to review general application code diffs; use diff-reviewer.
• Do not use to plan deployment steps; use deployment-checklist-maker.

4. Required Inputs

• config_content: Text content of the configuration file.
• config_type: File format (e.g. Dockerfile, Kubernetes YAML, GitHub Action, Nginx conf).

5. Missing-Input Behavior

1. If config_content is missing: ask for the file path or text.
2. If config_type is not specified: infer from file name (Dockerfile, deploy.yaml, nginx.conf).
3. Never output actual values of hardcoded secrets detected in files.

6. Procedure

Follow these numbered actions:

1. Action 1: Secret Scan
   • Check for plaintext passwords, tokens, API keys, and private certificates.
2. Action 2: Privilege and Execution Safety
   • In Dockerfile: check if USER is set to non-root.
   • In Kubernetes: check securityContext.runAsNonRoot and allowPrivilegeEscalation: false.
   • In CI/CD: check for untrusted pull_request_target triggers with script execution.
3. Action 3: Resource Limits & Network Exposure
   • Check for missing CPU/RAM requests/limits.
   • Check for unneeded public port exposures (EXPOSE 22).
4. Action 4: Assign Risk Classification
   • CRITICAL: Hardcoded secret or remote code execution vulnerability.
   • HIGH: Container running as root or missing securityContext.
   • MEDIUM: Missing resource limits or latest tag in image reference.
   • LOW: Stylistic or minor efficiency suggestion.
5. Action 5: Emit Risk Audit
   • Format per Section 8.

7. Decision Rules

• If a hardcoded secret is found: mask the secret (e.g. sk-****...) and mark overall risk as CRITICAL.
• If Docker image uses :latest tag: flag as MEDIUM risk (reproducibility hazard).

8. Output Format

Emit the audit using this template:

### Configuration Risk Audit: [Config File Name]

- **Overall Risk**: [CRITICAL | HIGH | MEDIUM | LOW]
- **Findings Count**: [Count] (Critical: [C], High: [H], Medium: [M], Low: [L])

#### Findings Table
| Line | Severity | Issue | Remediation |
| :--- | :--- | :--- | :--- |
| `[Line #]` | **CRITICAL** | Hardcoded API Token | Remove token; inject via environment secret. |
| `[Line #]` | **HIGH** | Container runs as root | Add `USER nonroot` before `ENTRYPOINT`. |

#### Recommended Action
- [Summary of priority remediation steps]

9. Verification Checklist

• Hardcoded secrets are masked in output.
• Findings cite line numbers and concrete remediation.
• Root user execution and missing resource limits checked.
• Overall risk rating reflects highest finding severity.

10. Common Failures and Recovery

11. Stop or Escalation Conditions

Stop and ask the user when:

• File is encrypted or encoded in unknown proprietary format.

12. Examples

Example 1: Successful Execution

Input:

FROM node:20
WORKDIR /app
COPY . .
RUN npm install
CMD ["node", "server.js"]

Output:

### Configuration Risk Audit: Dockerfile

- **Overall Risk**: HIGH
- **Findings Count**: 2 (Critical: 0, High: 1, Medium: 1, Low: 0)

#### Findings Table
| Line | Severity | Issue | Remediation |
| :--- | :--- | :--- | :--- |
| Line 5 | **HIGH** | Container runs as root user | Add `USER node` before `CMD` to avoid running container process with root privileges. |
| Line 4 | **MEDIUM** | Cache busting on `COPY . .` | Copy `package*.json` and run `npm install` before copying full source code. |

#### Recommended Action
Add non-root user instruction and split dependency copy to improve security and build caching.

Example 2: Ambiguous or Missing Input

Input:

Review my config: (Empty input)

Output:

### Configuration Risk Audit: Halted - No Content

- **Status**: Halted

Please provide the configuration file text or path to review.

Example 3: Expected Final Output

Output:

### Configuration Risk Audit: deployment.yaml

- **Overall Risk**: CRITICAL
- **Findings Count**: 1 (Critical: 1, High: 0, Medium: 0, Low: 0)

#### Findings Table
| Line | Severity | Issue | Remediation |
| :--- | :--- | :--- | :--- |
| Line 18 | **CRITICAL** | Plaintext database password in env var | Move `DB_PASSWORD` to a Kubernetes Secret and reference via `secretKeyRef`. |

#### Recommended Action
Immediately rotate the exposed database credential and transition to Kubernetes Secrets.