A PUBLIC_STRIPE_SECRET_KEY in .env.production, or import.meta.env.OPENAI_API_KEY passed as a prop to a client:load island, ends up in the JavaScript and HTML that every visitor downloads. A ?q= value passed to set:html lets anyone send a link that runs scripts on your domain. This skill finds those and the other Astro mistakes below before you deploy, and tells you how to fix each one.

Your agent runs a scanner on astro.config files, .astro pages and components (frontmatter, template and scripts), endpoints, middleware and actions, .env files, and components that read PUBLIC_ variables. It knows Astro's rules: only PUBLIC_ variables and astro:env client fields reach the browser, client:* props and define:vars values are serialized into the page while server:defer props are encrypted, set:html is not escaped, Astro.params is fixed at build time only on prerendered pages, and checkOrigin is on by default. It treats publishable, anon and browser map keys, feature switches and flags made from a secret (!!key) as fine, reads .env files only in folders that hold Astro files, does not warn about remote images on static builds, and never builds or runs your project. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• A01: a secret-named variable made public: PUBLIC_ variables in .env files and code, astro:env fields with context "client", and PUBLIC_ values in known key formats
• A02: vite.define given the whole environment, a secret-named variable or a literal key
• A03: server secrets (or objects holding them) passed to client:* islands, define:vars, HTML attributes or page text
• A04: set:html with query string, form, header or on-demand route data, also through a Markdown renderer
• A05: CORS that copies the request Origin into Access-Control-Allow-Origin with credentials and no allow list

REVIEW (check before release)

• A11: security.checkOrigin turned off
• A12: security.allowedDomains that trusts any forwarded host
• A13: image.remotePatterns that allow any host on a site rendered on demand
• A14: redirects to a ?next= or form value that is not checked first
• A15: source maps published with the build
• A16: session or token cookies set without httpOnly and secure
• A17: astro:env secrets marked public on the server, or given a literal default
• A18: CORS "*" together with credentials

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official source for each rule
• A risky and a safe example shop (config, .env, pages and API routes), and the real report the scanner produces on the risky one

Limits

It reads each file on its own and follows values only through simple assignments in the same file, so data passed through imported helpers or parent components is not followed. Hosting headers, CDN rules and whether an endpoint or action checks who the user is are not known, Markdown and MDX content is not read, and JSX, TSX, Vue and Svelte components are checked only for PUBLIC_ secrets. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 22 files: SKILL.md, the scanner in scripts/ (7 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.