commitshow-production-audit

A Claude Code skill that audits a shipped repo for the production-readiness gaps ~70% of AI-coded projects miss. Companion to in-session security skills (security-review, vibesec) — those scan the editor buffer, this one scans the deployed product after you commit.

What it checks

GitHub signals · secrets exposure · RLS gaps · webhook idempotency · DB index coverage · observability · prompt injection · ten more failure modes that AI-assisted projects routinely miss.

The actual audit engine runs at commit.show. The skill is the prompt + workflow that tells Claude Code when and how to invoke it. The bundled SKILL.md is the canonical content (~7KB, no code, no dependencies).

Installation

This package is documentation-only. The recommended install path is the Claude Code skills CLI:

npx skills add https://github.com/commitshow/production-audit --skill production-audit

Or browse the listing at skills.sh/commitshow/production-audit.

Why this package exists on npm

The skill itself ships through GitHub and the Claude Code skills marketplace. We publish a metadata-only package on npm so:

1. The name is reserved (no typosquat risk).
2. Security scanners that only index npm packages (Snyk, etc.) can verify the skill has zero dependencies and no executable code beyond the SKILL.md prompt.
3. Users who prefer browsing npm have a discoverable entry.

The SKILL.md and LICENSE are the only payload files. Run npm install and you'll get plain Markdown — nothing executes.

Source

• GitHub: https://github.com/commitshow/production-audit
• Audit engine source: https://github.com/commitshow/commitshow
• CLI: npx commitshow@latest audit <github-url> (npm)

License

MIT.