# Healthcheck

> Security audit and environment hardening. Use when asked about security, system health, or deployment safety. Use when this capability is needed.

- Skill: `tomevault-io/healthcheck-6` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add tomevault-io/healthcheck-6`
- Raw SKILL.md: https://api.skillmd.com/api/skills/tomevault-io/healthcheck-6/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- Author: tomevault-io (https://skillmd.com/u/tomevault-io)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/tomevault-io/healthcheck-6

---


# Health Check & Security Audit

## Overview

Audit the development environment and project for security issues, misconfigurations, and best practices compliance.

## Safety

- **Require explicit approval** before any state-changing action.
- **Prefer reversible changes** with a rollback plan.
- Never modify SSH, firewall, or auth configs without confirmation.

## Workflow

### 1. Environment Check
```bash
buddy doctor  # Run Code Buddy diagnostics
```

### 2. Project Security Scan

#### Dependencies
```bash
npm audit                          # Check for known vulnerabilities
npm outdated                       # Find outdated packages
npx license-checker --summary      # Check license compliance
```

#### Secrets Detection
```bash
# Check for hardcoded secrets
rg -i "(api_key|apikey|secret|password|token)\s*[:=]" src/ --type ts --type js
rg -i "-----BEGIN.*PRIVATE KEY" .
# Check .env is gitignored
git check-ignore .env
```

#### Code Quality
```bash
npm run lint                       # Linting issues
npx tsc --noEmit                   # Type errors
npm test                           # Test suite
```

### 3. Git Security
```bash
# Check for large files in history
git rev-list --objects --all | git cat-file --batch-check='%(objecttype) %(objectname) %(objectsize) %(rest)' | sort -k3 -n -r | head -20

# Check for sensitive files tracked
git ls-files | rg -i '(\.env|\.pem|\.key|credentials|secret)'

# Verify .gitignore covers sensitive patterns
cat .gitignore | rg '(\.env|node_modules|dist|\.key|\.pem)'
```

### 4. Production Readiness
- [ ] Environment variables documented in `.env.example`
- [ ] No `console.log` debugging left in production code
- [ ] Error handling on all external API calls
- [ ] Rate limiting on public endpoints
- [ ] CORS configured explicitly (not `*`)
- [ ] Authentication on sensitive routes
- [ ] Input validation at system boundaries
- [ ] Dependencies pinned or lockfile committed

## Output Format

```markdown
## Security Audit Report

### Environment: OK / WARN / FAIL
- Node.js: v22.x ✅
- Dependencies: 2 vulnerabilities ⚠️
- ...

### Secrets: OK / WARN / FAIL
- No hardcoded secrets found ✅
- .env is gitignored ✅
- ...

### Code Quality: OK / WARN / FAIL
- Lint: 0 errors ✅
- Types: 0 errors ✅
- Tests: 45 passing ✅

### Recommendations
1. Fix 2 moderate npm vulnerabilities: `npm audit fix`
2. ...
```

---
> Converted and distributed by [TomeVault](https://tomevault.io/claim/phuetz) — claim your Tome and manage your conversions.
<!-- tomevault:4.0:skill_md:2026-04-11 -->