A STRIPE_SECRET_KEY left in the env block of vercel.json is readable by everyone who can see the repository, and a rewrite from /u/:id* to https://:id.example.com/ lets anyone point your domain at a site of their choice. This skill finds those and six other deploy config mistakes before you deploy, and tells you how to fix each one.

Your agent runs a scanner on your Vercel and Netlify configs: vercel.json (env, build.env, headers, redirects, rewrites, and routes with their transforms), netlify.toml (build and deploy-context environments, dev, plugin inputs, redirects with proxy headers, headers), and headers and redirects files (the same format Cloudflare Pages reads). It knows path parameters such as :id(\d+), Netlify splats and query placeholders, has captures and route env lists, so restricted parameters and environment references are not reported. For missing headers it looks at the whole project, including next.config, middleware and Netlify edge functions. It never deploys, builds or contacts a server. It returns BLOCK, REVIEW, or NOT FLAGGED, with the file, line, reason, and a safer approach. Secrets are never printed.

What it checks

BLOCK (fix before shipping)

• D01: API keys, tokens and passwords written in Vercel env or build.env, Netlify build or context environments, dev jwtSecret, plugin inputs, Netlify proxy headers, Vercel route transforms, Basic-Auth lines, or redirect URLs

• D02: Access-Control-Allow-Credentials true with Allow-Origin null or an origin copied from the request that can match any site (a capture limited to your own origins is fine)

• D03: redirects, rewrites and proxies whose target host comes from the request (https://:splat, https://:id.example.com with an unrestricted :id)

REVIEW (check before release)

• D11: no X-Frame-Options or CSP frame-ancestors, or no X-Content-Type-Options nosniff, anywhere in the project's header rules

• D12: weak header values: X-Frame-Options ALLOW-FROM, frame-ancestors *, Referrer-Policy unsafe-url, an HSTS max-age under one year

• D13: Access-Control-Allow-Origin * on Vercel API routes, or with write methods or an Authorization header

• D14: redirect, rewrite or proxy targets on plain http://

• D15: Allow-Origin * with Allow-Credentials true, which browsers refuse (a broken config rather than a leak)

What's included

• The scanner (Python 3.9+, standard library only)

• A rules guide with the reason and safer approach for each rule

• A risky and a safe example project (a Vercel app and a Netlify site with headers and redirects), and the real report the scanner produces on the risky one

Limits

It reads each config as written: settings made in the Vercel or Netlify dashboard (environment variables, password protection, domains), headers set in server code outside the framework files it reads, the rules in vercel.ts, bulk redirect files and what a proxied backend returns are not checked. D11 (REVIEW) appears on most projects that have not added custom security headers, and headers set in application code (helmet in an Express server, middleware outside the files it reads) are not seen. NOT FLAGGED is not a guarantee.

Contents

One ZIP file with 15 files: SKILL.md, the scanner in scripts/ (4 Python files), references/rules.md (every rule with its reason and safer approach), and examples/ (8 example files plus report.md, the real scanner output on the risky example).

How to use: This is an agent skill: a folder with a SKILL.md file and Python scripts that an AI coding agent such as Claude Code, Cursor, or Codex CLI can run. Unzip it into your agent's skills folder (for Claude Code: ~/.claude/skills/), then ask your agent to check your project. The scripts also run on their own with Python 3.9 or newer, with nothing to install. They read your files only: no network access, and nothing is sent anywhere.