How do I install the Healthcheck skill?

Run npx skillmds@latest add tomevault-io/healthcheck-6 in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Healthcheck safe to use?

This skill has not completed SkillMD's automated safety review yet. Independent scanners report: SkillSpector: CAUTION, Skill Scanner: PASS. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Healthcheck?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Healthcheck free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Healthcheck?

tomevault-io (@tomevault-io) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Healthcheck by tomevault-io — Agent Skill

Name: Healthcheck
Author: tomevault-io

File contents

Health Check & Security Audit

Overview

Audit the development environment and project for security issues, misconfigurations, and best practices compliance.

Safety

Require explicit approval before any state-changing action.
Prefer reversible changes with a rollback plan.
Never modify SSH, firewall, or auth configs without confirmation.

Workflow

1. Environment Check

buddy doctor  # Run Code Buddy diagnostics

2. Project Security Scan

Dependencies

npm audit                          # Check for known vulnerabilities
npm outdated                       # Find outdated packages
npx license-checker --summary      # Check license compliance

Secrets Detection

# Check for hardcoded secrets
rg -i "(api_key|apikey|secret|password|token)\s*[:=]" src/ --type ts --type js
rg -i "-----BEGIN.*PRIVATE KEY" .
# Check .env is gitignored
git check-ignore .env

Code Quality

npm run lint                       # Linting issues
npx tsc --noEmit                   # Type errors
npm test                           # Test suite

3. Git Security

# Check for large files in history
git rev-list --objects --all | git cat-file --batch-check='%(objecttype) %(objectname) %(objectsize) %(rest)' | sort -k3 -n -r | head -20

# Check for sensitive files tracked
git ls-files | rg -i '(\.env|\.pem|\.key|credentials|secret)'

# Verify .gitignore covers sensitive patterns
cat .gitignore | rg '(\.env|node_modules|dist|\.key|\.pem)'

4. Production Readiness

Environment variables documented in .env.example
No console.log debugging left in production code
Error handling on all external API calls
Rate limiting on public endpoints
CORS configured explicitly (not *)
Authentication on sensitive routes
Input validation at system boundaries
Dependencies pinned or lockfile committed

Output Format

## Security Audit Report

### Environment: OK / WARN / FAIL
- Node.js: v22.x ✅
- Dependencies: 2 vulnerabilities ⚠️
- ...

### Secrets: OK / WARN / FAIL
- No hardcoded secrets found ✅
- .env is gitignored ✅
- ...

### Code Quality: OK / WARN / FAIL
- Lint: 0 errors ✅
- Types: 0 errors ✅
- Tests: 45 passing ✅

### Recommendations
1. Fix 2 moderate npm vulnerabilities: `npm audit fix`
2. ...

Converted and distributed by TomeVault — claim your Tome and manage your conversions.

---name: healthcheck-6description: Security audit and environment hardening. Use when asked about security, system health, or deployment safety. Use when this capability is needed.---# Health Check & Security Audit## OverviewAudit the development environment and project for security issues, misconfigurations, and best practices compliance.## Safety- **Require explicit approval** before any state-changing action.- **Prefer reversible changes** with a rollback plan.- Never modify SSH, firewall, or auth configs without confirmation.## Workflow### 1. Environment Check```bashbuddy doctor # Run Code Buddy diagnostics```### 2. Project Security Scan#### Dependencies```bashnpm audit # Check for known vulnerabilitiesnpm outdated # Find outdated packagesnpx license-checker --summary # Check license compliance```#### Secrets Detection```bash# Check for hardcoded secretsrg -i "(api_key|apikey|secret|password|token)\s*[:=]" src/ --type ts --type jsrg -i "-----BEGIN.*PRIVATE KEY" .# Check .env is gitignoredgit check-ignore .env```#### Code Quality```bashnpm run lint # Linting issuesnpx tsc --noEmit # Type errorsnpm test # Test suite```### 3. Git Security```bash# Check for large files in historygit rev-list --objects --all | git cat-file --batch-check='%(objecttype) %(objectname) %(objectsize) %(rest)' | sort -k3 -n -r | head -20# Check for sensitive files trackedgit ls-files | rg -i '(\.env|\.pem|\.key|credentials|secret)'# Verify .gitignore covers sensitive patternscat .gitignore | rg '(\.env|node_modules|dist|\.key|\.pem)'```### 4. Production Readiness- [ ] Environment variables documented in `.env.example`- [ ] No `console.log` debugging left in production code- [ ] Error handling on all external API calls- [ ] Rate limiting on public endpoints- [ ] CORS configured explicitly (not `*`)- [ ] Authentication on sensitive routes- [ ] Input validation at system boundaries- [ ] Dependencies pinned or lockfile committed## Output Format```markdown## Security Audit Report### Environment: OK / WARN / FAIL- Node.js: v22.x ✅- Dependencies: 2 vulnerabilities ⚠️- ...### Secrets: OK / WARN / FAIL- No hardcoded secrets found ✅- .env is gitignored ✅- ...### Code Quality: OK / WARN / FAIL- Lint: 0 errors ✅- Types: 0 errors ✅- Tests: 45 passing ✅### Recommendations1. Fix 2 moderate npm vulnerabilities: `npm audit fix`2. ...```---> Converted and distributed by [TomeVault](https://tomevault.io/claim/phuetz) — claim your Tome and manage your conversions.

Frequently asked questions

Healthcheck