A password: "{{ db_password }}" task without no_log: true prints the password in Ansible's output and in your CI logs, and a db_password written in group_vars sits in git history for good. This skill finds those and six other risky Ansible settings, and tells you how to fix each one.

Your agent runs a scanner on your playbooks, roles (tasks, handlers, defaults, vars), inventories (YAML or INI), group_vars and host_vars files, and ansible.cfg. It reads blocks, handlers, short and full module names (apt or ansible.builtin.apt), key=value arguments and args:, and treats !vault values and templates as safe. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secret values are never printed.

What it checks

BLOCK (fix before shipping)

• A01: a password, token or key in plain text in vars or a module parameter

• A02: curl or wget piped into a shell in a shell, command or raw task

REVIEW (check before release)

• A11: a secret passed to a task without no_log: true

• A12: validate_certs: no or curl -k

• A13: a world-writable mode such as 0777

• A14: state: latest on package tasks

• A15: a git checkout of a branch instead of a tag or commit

• A16: SSH host key checking turned off

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example playbook, and the real report the scanner produces on the risky one

Limits

It reads YAML text and does not run Jinja, resolve variables from other files, or follow include_tasks and roles from collections. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 9 files: SKILL.md, the scanner in scripts/ (3 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (3 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.