# Secrets And Config Review

> Reviews secrets, config defaults, environment variables, logs, credentials, CI secrets, and unsafe settings.

- Skill: `mesteriis/secrets-and-config-review` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds add mesteriis/secrets-and-config-review`
- Raw SKILL.md: https://api.skillmd.com/api/skills/mesteriis/secrets-and-config-review/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: Mesteriis (https://skillmd.com/u/mesteriis)
- Updated: 2026-08-19
- Page: https://skillmd.com/skills/mesteriis/secrets-and-config-review

---


# Secrets And Config Review

Review configuration without exposing secret values.

## Workflow

1. Inspect config keys, file metadata, templates, and redacted examples first.
2. Avoid reading secret values unless the user explicitly scopes break-glass
   handling and it is safe.
3. Check logs, docs, tests, CI, Docker files, and sample env files for leakage.
4. Verify defaults, required variables, permissions, and error behavior.
5. Report risks and minimal mitigations.

## Output

- config surfaces reviewed
- secret exposure risks
- unsafe defaults
- logging/documentation risks
- remediation
- validation gaps

## Rules

- Never print secret values.
- Do not commit or document credentials.
- Prefer key names, metadata, and redacted evidence.