Skills Guide

Release Readiness Audit

VerifiedCaution

Comprehensive release readiness audit covering security, dependencies, community files, and code quality. Use for pre-release verification.

Sby Skills Guide Bot
DevelopmentIntermediate
107/23/2026
Claude CodeCursorWindsurfCopilot
#release-readiness#security#audit#code-quality

Recommended for

Code reviewClaude CodeBackend developerCursorFrontend developerCopilot

Our review

Performs a comprehensive pre-release audit covering dependency vulnerabilities, community files, personal info leaks, secrets, code quality, and baseline security configuration.

Strengths

  • Checks multiple dimensions (security, code quality, configuration) in a single run.
  • Distinguishes between direct and transitive dependency issues.
  • Provides clear output with ✅/❌/⚠️ symbols.
  • Includes both automated checks and manual reminders for GitHub settings.

Limitations

  • Relies on npm audit, which may have false positives or miss vulnerabilities.
  • Some checks (like personal info leaks) may require domain-specific knowledge to avoid false hits.
  • Cannot verify GitHub repository settings automatically; requires manual confirmation.
When to use it

Use before any production release to ensure all common pitfalls are addressed.

When not to use it

Not suitable for quick checks on non-critical projects or when only a subset of checks is needed.

Security analysis

Caution
Quality score95/100

The skill instructs running shell commands for auditing purposes (npm audit, grep), which are powerful but legitimate. No destructive or exfiltrating actions.

Findings
  • •Uses bash and grep commands that access the filesystem; if output contains sensitive data, it could be exposed to the AI or user.

Examples

Full release readiness audit
Run a release readiness audit on the current project.
Pre-release check with security focus
Check if the project is ready for release, covering security and dependencies.
Pre-release verification
Perform a pre-release verification for this project.

name: release-check description: Comprehensive release readiness audit covering security, dependencies, community files, and code quality. Use when asked for a "release check", "release readiness" review, or "pre-release verification".

Release Readiness Audit

Pre-release cross-cutting check: security, dependencies, required community files, and code quality. Documentation and metadata checks live in /release-docs-check — run that separately.

1. Dependency vulnerabilities

npm audit --audit-level=high
  • Confirm zero High / Critical
  • If any remain, distinguish direct vs. transitive in the report
  • Note whether npm audit fix can resolve them

2. Required community files

Use Glob to confirm each file exists:

| File | Purpose | |------|---------| | LICENSE | License (required) | | README.md | Project overview (required) | | CONTRIBUTING.md | Contribution guide (required) | | SECURITY.md | Vulnerability reporting policy (required) | | CODE_OF_CONDUCT.md | Code of conduct (recommended) | | .env.example | Environment variable template (required) |

3. Personal / project-specific info leaks

Grep (excluding node_modules, .next, .git):

  • Personal domains / URLs: scan source for \.info, \.dev, \.me patterns
  • Personal names / handles: repository owner names must not be hardcoded in source
  • Project-specific names: your own project or brand names (e.g., my-blog-name) must not remain in source

Allowed locations: package.json, README.md, CONTRIBUTING.md, SECURITY.md, LICENSE, _release/.

4. Secrets / credential leaks

Grep for these patterns:

  • API key prefixes: sk-, AIza, ghp_, xoxb-, AKIA
  • Hardcoded passwords: password\s*=\s*["'][^"']{8,}
  • Bearer tokens: Bearer [A-Za-z0-9+/]{20,}

Read .env.example and verify it contains placeholders only.

5. Code quality

  • Stray console.log: Grep under app/(admin)/baan-admin/api/
  • TODO/FIXME/HACK: Grep under app/, lib/ (minor ones are warnings)
  • Japanese error messages: confirm API responses under app/(admin)/baan-admin/api/ do not contain Japanese (exclude translation files like _lib/i18n.ts)

6. Baseline security configuration

  • .gitignore: .env*, data/, *.pem, .session-secret, etc. are excluded
  • package.json: "private": true is set correctly (appropriate for an application)
  • TypeScript strict: tsconfig.json has strict: true

7. GitHub repository settings (manual)

Cannot be verified from code — confirm manually before release:

  • [ ] GitHub Private Vulnerability Reporting enabled (Security tab)
  • [ ] Default branch is main
  • [ ] Branch protection rules set up (if required)

Output format

Clean: ✅ OK Issue: ❌ description (file:line) Warning: ⚠️ description Manual check: 👤 description

Summary format

## Release Readiness

| Category | Status |
|----------|--------|
| Dependency vulnerabilities | ✅ / ❌ |
| Required community files | ✅ / ❌ |
| Personal info leaks | ✅ / ❌ |
| Secret leaks | ✅ / ❌ |
| Code quality | ✅ / ⚠️ / ❌ |
| Baseline security | ✅ / ❌ |

### Verdict
🟢 READY / 🟡 CAUTION / 🔴 NOT READY
Related skills

Next.js App Router Expert

Development

A skill that turns Claude into a Next.js App Router expert.

Claude CodeCursoradvanced
890
234
3,180
Admin

README Generator

Development

Creates professional and comprehensive README.md files for your projects.

claudeCursorWindsurfbeginner
259
72
1,083
Admin

API Documentation Writer

Development

Generates comprehensive API documentation in OpenAPI/Swagger format.

claudeCursorWindsurfintermediate
156
44
943
Admin