A chart that ships adminPassword: changeme123 in values.yaml, or {{ .Values.auth.password | default "admin" }} in a Secret template, hands that password to every install that does not override it and to everyone who can pull the chart. And {{ randAlphaNum 32 }} in a Secret without lookup quietly changes the database password on every helm upgrade. This skill finds those and ten other Helm chart mistakes before the chart is published or installed, and tells you how to fix each one.

Your agent runs a scanner on your chart: Chart.yaml, requirements.yaml, values.yaml and other values files, and the .yaml, .yml and .tpl files in templates/ (subcharts in charts/ too). Chart.yaml and values files are read as YAML. Templates hold Go template code that is not valid YAML, so they are read line by line, skipping {{/* */}} and # comments and telling values written out in the file from {{ ... }} references. It knows Helm conventions such as an empty image tag that falls back to appVersion, existingSecret and passwordKey names, components switched off with enabled: false, Bitnami resourcesPreset and helm test pods, so a fresh helm create chart gets only the review points it really has. It never runs helm, renders templates or connects to a cluster. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• H01: passwords, tokens and keys in values files and templates: secret-named keys, env values, literal Secret data, | default "..." fallbacks for secret values or inside a Secret's data, private keys and passwords in URLs

• H02: privileged: true in a template or values file

• H03: hostPath mounts of the Docker, containerd or CRI-O socket, or of the node root without readOnly

REVIEW (check before release)

• H11: tag: latest, images without a tag, default "latest" in templates and appVersion: latest (helm test pods are skipped)

• H12: hostNetwork, hostPID, hostIPC and other hostPath mounts, including a read-only mount of the node root as node exporters use

• H13: no memory limit in the default values, or workload templates with no resources block

• H14: containers that may run as root: runAsUser: 0, no runAsNonRoot in the default values, templates with no securityContext

• H15: dependencies from a chart repository with no version or an open-ended range (*, >=); local file:// subcharts are skipped

• H16: dependencies from plain http:// repositories

• H17: Services of type LoadBalancer without source ranges or an internal load balancer annotation

• H18: ingresses turned on without TLS, and Ingress templates with no tls section

• H19: Secrets generated with randAlphaNum, uuidv4 or genCA in a file that never uses lookup, so they change on every upgrade

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example chart (Chart.yaml, values.yaml, deployment, secret, service, ingress, DaemonSet and test templates), and the real report the scanner produces on the risky one

Limits

It reads the chart's files as written and does not render templates: values passed with --set or -f at install time, logic inside if and range blocks, named templates from other files and the defaults of subcharts that are not in the folder are not followed. Rendered manifests and the live cluster are not checked. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 24 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (17 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.