A literal DB_PASSWORD under provider.environment ends up in git, in the CloudFormation template Serverless uploads and in the Lambda console, and one IAM statement with Action '*' on Resource '*' gives every function the whole AWS account. This skill finds those and nine other Serverless Framework mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your serverless.yml, serverless.yaml and serverless.json files (stage copies such as serverless.prod.yml too) and on the YAML and JSON files they pull in with ${file(...)}. Paths with ${sls:stage} in them match every stage file, and files your .gitignore excludes are left alone. It knows Serverless variables (${ssm:...}, ${env:...}, ${self:...}), CloudFormation tags such as !Ref and !GetAtt under resources, and the framework's own defaults: cors: true means every origin, url: true means a function URL with no auth, a function without a timeout gets 6 seconds, and a runtime is reported once it is past its AWS deprecation date. It never runs serverless, calls AWS or deploys anything. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• L01: passwords, tokens and keys written in provider or function environment (also passwords inside URLs)

• L02: IAM statements with Action (or iam:) on Resource *, AdministratorAccess and IAMFullAccess

• L03: secrets in custom, params, plugin settings, API key values and CloudFormation properties under resources

• L04: secrets in files pulled in with ${file(...)} that .gitignore does not exclude

REVIEW (check before release)

• L11: http and httpApi routes without an authorizer

• L12: CORS open to every origin on http events, HTTP APIs and function URLs

• L13: Lambda runtimes past their AWS deprecation date (nodejs18.x, nodejs20.x, python3.9 and others)

• L14: function URLs with no auth (url: true)

• L15: timeouts longer than API Gateway waits (29 seconds for REST APIs, 30 for HTTP APIs)

• L16: whole-service IAM wildcards such as dynamodb:* on , iam:PassRole on , NotAction and PowerUserAccess

• L17: secrets copied from SSM or the environment into Lambda environment variables at deploy time

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example service, and the real report the scanner produces on the risky one

Limits

It reads your config files as written. serverless.ts and serverless.js configs, values passed at deploy time (--param, environment variables, SSM contents) and plugin defaults are not evaluated, and functions defined in files pulled in with ${file(...)} are checked for secrets only. Buckets, security groups and databases under resources need a CloudFormation checker. The runtime deprecation dates come from the AWS Lambda runtimes page as of November 2026; AWS calls them projected dates that may change. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 16 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.