"start": "deno serve -A main.ts" turns Deno's sandbox off for every dependency your server loads, and one --unsafely-ignore-certificate-errors in a task lets anyone on the network swap the modules Deno downloads. This skill finds those and eleven other Deno configuration mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on deno.json and deno.jsonc (comments and trailing commas are fine), import maps, deno.lock, package.json scripts, .gitignore, the deno commands in Dockerfiles, Compose files, systemd units, Procfiles and shell scripts, and the imports and Deno.Command calls in your TypeScript and JavaScript. It reads deno commands the way deno does: flags after the script name belong to the script, -qA contains -A, and --allow-run=git is a list while --allow-run is not. Permission findings apply to production commands (start and serve tasks, Dockerfile CMD and ENTRYPOINT, Compose commands, systemd ExecStart, Procfiles, deno compile), not to dev, test, build or --watch tasks. It never runs deno, your tasks or your code. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• D01: modules loaded over plain http in deno.json imports or scopes, import maps, import statements, deno.lock or deno commands (localhost is fine)
• D02: --unsafely-ignore-certificate-errors for every host or for hosts other than localhost
• D03: Deno.Command or Deno.run starting sh, bash, cmd or PowerShell with a command string built from Deno.args, Deno.env, request data or a function parameter
• D04: DENO_AUTH_TOKENS, DENO_KV_ACCESS_TOKEN and other tokens written in Dockerfiles, Compose, systemd units, tasks and scripts, and credentials inside module URLs

REVIEW (check before release)

• D11: -A / --allow-all on production commands, or "all": true in a deno.json permission set
• D12: --allow-run without a list or for deno, a shell or an interpreter, and --allow-ffi (flags or deno.json permission sets)
• D13: --allow-write without a path list
• D14: "lock": false, --no-lock, or deno.lock ignored in the .gitignore of a Deno project
• D15: https imports with no version, tag or commit, and jsr: or npm: import-map entries with no version or latest
• D16: npm install scripts allowed for every package (--allow-scripts with no list, "allowScripts": true)
• D17: --inspect, --inspect-brk or --inspect-wait bound to 0.0.0.0 or another non-loopback address
• D18: a shell command string built from other values or held in a variable (a version, a path, a helper's argument)
• D19: "minimumDependencyAge": 0, which turns off Deno's default 24-hour wait before installing a newly published npm or JSR version

What's included

• The scanner (Python 3.9+, standard library only)
• A rules guide with the reason, safer approach and official Deno documentation link for each rule
• A risky and a safe example project, and the real report the scanner produces on the risky one

Limits

It reads each file on its own: a task that calls another task, a permission set chosen with -P, commands run over ssh and values from .env files are not followed, and shell command strings are traced through one variable in the same file only. Unscoped --allow-net, --allow-read, --allow-env and --allow-sys are not reported, because most servers need them and Deno's own Docker examples use them. GitHub Actions workflows, Makefiles and Kubernetes manifests are not read. The official Fresh start task and the Fresh Docker guide use -A and --allow-scripts for every package; these are reported as REVIEW on purpose. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 20 files: SKILL.md, the scanner in scripts/ (5 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (12 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.